From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-6.8 required=3.0 tests=DKIMWL_WL_HIGH,DKIM_SIGNED, DKIM_VALID,HEADER_FROM_DIFFERENT_DOMAINS,MAILING_LIST_MULTI,SIGNED_OFF_BY, SPF_PASS,URIBL_BLOCKED,USER_AGENT_GIT autolearn=unavailable autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 0E6A3C43387 for ; Tue, 15 Jan 2019 16:55:41 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id C92CA20657 for ; Tue, 15 Jan 2019 16:55:40 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1547571340; bh=2WFzXCH7zjc0ZF0MW+oWE32T+wcTNfwfsx5addggZuI=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-ID:From; b=iR6qpjnCL9TZyyPsTideWuucyn0rZA2PskUA7ATjZEdfCJfk1T7Ar6Nx0M13vsyVY tjB+Cbov8pPHUo1y/dj4CwCAT8iww25OhXPaWY31G9QQ89cndUqSxIW+BD3tIf4Ze6 rFQhS9aMsXQ75/tl9e5vxOUkgFenhU8uC0PPuR+Q= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1729151AbfAOQmM (ORCPT ); Tue, 15 Jan 2019 11:42:12 -0500 Received: from mail.kernel.org ([198.145.29.99]:58940 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1728587AbfAOQmG (ORCPT ); Tue, 15 Jan 2019 11:42:06 -0500 Received: from localhost (5356596B.cm-6-7b.dynamic.ziggo.nl [83.86.89.107]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id 1814B20645; Tue, 15 Jan 2019 16:42:04 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1547570525; bh=2WFzXCH7zjc0ZF0MW+oWE32T+wcTNfwfsx5addggZuI=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=LPo6mOOaR3z9iPBFBS5XOjb6Nk+46L7UIfY+ETR6Pr8NXc3rYmopHnp0JUEHe2NFw iKkMhAtEcvE6M+9duIMZW420jcQc+pmKH5W099ky9Q0CUZJTUqbGLvqbe6ySxATq9X jH4vcMCMpgXgw2ILvEkCfjq06NsI4x5KE8JYkg0g= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Pei Zhang , Dan Carpenter , Peter Xu , Cornelia Huck , Alex Williamson Subject: [PATCH 4.19 26/50] vfio/type1: Fix unmap overflow off-by-one Date: Tue, 15 Jan 2019 17:36:02 +0100 Message-Id: <20190115154911.472762784@linuxfoundation.org> X-Mailer: git-send-email 2.20.1 In-Reply-To: <20190115154909.933241945@linuxfoundation.org> References: <20190115154909.933241945@linuxfoundation.org> User-Agent: quilt/0.65 X-stable: review X-Patchwork-Hint: ignore MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Sender: stable-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org 4.19-stable review patch. If anyone has any objections, please let me know. ------------------ From: Alex Williamson commit 58fec830fc19208354895d9832785505046d6c01 upstream. The below referenced commit adds a test for integer overflow, but in doing so prevents the unmap ioctl from ever including the last page of the address space. Subtract one to compare to the last address of the unmap to avoid the overflow and wrap-around. Fixes: 71a7d3d78e3c ("vfio/type1: silence integer overflow warning") Link: https://bugzilla.redhat.com/show_bug.cgi?id=1662291 Cc: stable@vger.kernel.org # v4.15+ Reported-by: Pei Zhang Debugged-by: Peter Xu Reviewed-by: Dan Carpenter Reviewed-by: Peter Xu Tested-by: Peter Xu Reviewed-by: Cornelia Huck Signed-off-by: Alex Williamson Signed-off-by: Greg Kroah-Hartman --- drivers/vfio/vfio_iommu_type1.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) --- a/drivers/vfio/vfio_iommu_type1.c +++ b/drivers/vfio/vfio_iommu_type1.c @@ -878,7 +878,7 @@ static int vfio_dma_do_unmap(struct vfio return -EINVAL; if (!unmap->size || unmap->size & mask) return -EINVAL; - if (unmap->iova + unmap->size < unmap->iova || + if (unmap->iova + unmap->size - 1 < unmap->iova || unmap->size > SIZE_MAX) return -EINVAL;