From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-6.8 required=3.0 tests=DKIMWL_WL_HIGH,DKIM_SIGNED, DKIM_VALID,HEADER_FROM_DIFFERENT_DOMAINS,MAILING_LIST_MULTI,SIGNED_OFF_BY, SPF_PASS,URIBL_BLOCKED,USER_AGENT_GIT autolearn=unavailable autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 57B30C43387 for ; Tue, 15 Jan 2019 16:46:35 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id 1CEC52054F for ; Tue, 15 Jan 2019 16:46:35 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1547570795; bh=mq03ULgkvFS67zK5ltqYOhAzfaHfXFIXq+gr+Nf3pEw=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-ID:From; b=mIJnLNpKOlXGsZTDvKGZf9LhpAGKg6leRz4nuqNqT6tNwVBpDu36v1YbZaCJi3xD1 +rztIdWC86yB7Qsy8dq6B+c9VNqsfcmxRv12qUS7Lpr6Q/CBfJ3LfD5xQOhFyyhXsY IfVdR7xjr3tp5dD7rAVcaVaN+cHy4umJmLaSndQc= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S2387902AbfAOQqD (ORCPT ); Tue, 15 Jan 2019 11:46:03 -0500 Received: from mail.kernel.org ([198.145.29.99]:35742 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S2387899AbfAOQqC (ORCPT ); Tue, 15 Jan 2019 11:46:02 -0500 Received: from localhost (5356596B.cm-6-7b.dynamic.ziggo.nl [83.86.89.107]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id C08E520675; Tue, 15 Jan 2019 16:46:01 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1547570762; bh=mq03ULgkvFS67zK5ltqYOhAzfaHfXFIXq+gr+Nf3pEw=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=WDjIQaJ8kZLFtUJsGPrG9OjfB9Q4NJCA9dLwnJq0ErdSZPHFLk3VHlQTC1WivEVwS rzpb1ryrkbjGmhzTw+LMmCF+Xl6rJK9SShbz54udSvsDAuWO0cxQhYsQmYb1ahSjJm TELBh2hlzjxZ+AKWw/n3IpYlnNIPyi1Jy4jowWjo= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Pei Zhang , Dan Carpenter , Peter Xu , Cornelia Huck , Alex Williamson Subject: [PATCH 4.20 36/57] vfio/type1: Fix unmap overflow off-by-one Date: Tue, 15 Jan 2019 17:36:17 +0100 Message-Id: <20190115154912.798297882@linuxfoundation.org> X-Mailer: git-send-email 2.20.1 In-Reply-To: <20190115154910.734892368@linuxfoundation.org> References: <20190115154910.734892368@linuxfoundation.org> User-Agent: quilt/0.65 X-stable: review X-Patchwork-Hint: ignore MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Sender: stable-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org 4.20-stable review patch. If anyone has any objections, please let me know. ------------------ From: Alex Williamson commit 58fec830fc19208354895d9832785505046d6c01 upstream. The below referenced commit adds a test for integer overflow, but in doing so prevents the unmap ioctl from ever including the last page of the address space. Subtract one to compare to the last address of the unmap to avoid the overflow and wrap-around. Fixes: 71a7d3d78e3c ("vfio/type1: silence integer overflow warning") Link: https://bugzilla.redhat.com/show_bug.cgi?id=1662291 Cc: stable@vger.kernel.org # v4.15+ Reported-by: Pei Zhang Debugged-by: Peter Xu Reviewed-by: Dan Carpenter Reviewed-by: Peter Xu Tested-by: Peter Xu Reviewed-by: Cornelia Huck Signed-off-by: Alex Williamson Signed-off-by: Greg Kroah-Hartman --- drivers/vfio/vfio_iommu_type1.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) --- a/drivers/vfio/vfio_iommu_type1.c +++ b/drivers/vfio/vfio_iommu_type1.c @@ -878,7 +878,7 @@ static int vfio_dma_do_unmap(struct vfio return -EINVAL; if (!unmap->size || unmap->size & mask) return -EINVAL; - if (unmap->iova + unmap->size < unmap->iova || + if (unmap->iova + unmap->size - 1 < unmap->iova || unmap->size > SIZE_MAX) return -EINVAL;