From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-6.0 required=3.0 tests=DKIMWL_WL_HIGH,DKIM_SIGNED, DKIM_VALID,HEADER_FROM_DIFFERENT_DOMAINS,MAILING_LIST_MULTI,SIGNED_OFF_BY, SPF_PASS,USER_AGENT_GIT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id A05B2C04E84 for ; Wed, 15 May 2019 11:34:02 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id 6893520881 for ; Wed, 15 May 2019 11:34:02 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1557920042; bh=xSihnVmtY+9iC4up/Mcox0MkU/6kFtZPpELlpQf8rew=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-ID:From; b=ochAfTa/GQC6fUWVJjyzO1w1OPKPG+r9nusB6C3d3bytTOMTfU9eOmlG+jTD1fRNK dsfmseI/5sfXWxByjABh3m+9+J8Nw2YgtUlnE8hfsu8mr/mrZQ0UL8eiKon1OTY4KE ClFJ9kpoksI9+Ojm3mmAbdqq6ybIiw73YJHgzfS8= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1733295AbfEOLeB (ORCPT ); Wed, 15 May 2019 07:34:01 -0400 Received: from mail.kernel.org ([198.145.29.99]:45986 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1733280AbfEOLeA (ORCPT ); Wed, 15 May 2019 07:34:00 -0400 Received: from localhost (83-86-89-107.cable.dynamic.v4.ziggo.nl [83.86.89.107]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id 02EE620881; Wed, 15 May 2019 11:33:58 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1557920039; bh=xSihnVmtY+9iC4up/Mcox0MkU/6kFtZPpELlpQf8rew=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=G3H2vSP8D382FFdbro3JJgki2EYWQDXZWtvdMc3iz6GhiyxU/Qn1C4zwKSsrbKSMs SV9wpcf6yILGpM1wnlb+j/4PFvFVjJ7F5vS0HRRXiQCg9OxoVGcCS7O7NGMPs1Yr59 1J706GlJQVjWMn48Dc6uXNeRa7nMdBOXi2sy2X1U= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Dan Carpenter , Andrew Morton , Timur Tabi , Mihai Caraman , Kumar Gala , Linus Torvalds Subject: [PATCH 5.1 38/46] drivers/virt/fsl_hypervisor.c: prevent integer overflow in ioctl Date: Wed, 15 May 2019 12:57:02 +0200 Message-Id: <20190515090627.858739406@linuxfoundation.org> X-Mailer: git-send-email 2.21.0 In-Reply-To: <20190515090616.670410738@linuxfoundation.org> References: <20190515090616.670410738@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Sender: stable-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Dan Carpenter commit 6a024330650e24556b8a18cc654ad00cfecf6c6c upstream. The "param.count" value is a u64 thatcomes from the user. The code later in the function assumes that param.count is at least one and if it's not then it leads to an Oops when we dereference the ZERO_SIZE_PTR. Also the addition can have an integer overflow which would lead us to allocate a smaller "pages" array than required. I can't immediately tell what the possible run times implications are, but it's safest to prevent the overflow. Link: http://lkml.kernel.org/r/20181218082129.GE32567@kadam Fixes: 6db7199407ca ("drivers/virt: introduce Freescale hypervisor management driver") Signed-off-by: Dan Carpenter Reviewed-by: Andrew Morton Cc: Timur Tabi Cc: Mihai Caraman Cc: Kumar Gala Cc: Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds Signed-off-by: Greg Kroah-Hartman --- drivers/virt/fsl_hypervisor.c | 3 +++ 1 file changed, 3 insertions(+) --- a/drivers/virt/fsl_hypervisor.c +++ b/drivers/virt/fsl_hypervisor.c @@ -215,6 +215,9 @@ static long ioctl_memcpy(struct fsl_hv_i * hypervisor. */ lb_offset = param.local_vaddr & (PAGE_SIZE - 1); + if (param.count == 0 || + param.count > U64_MAX - lb_offset - PAGE_SIZE + 1) + return -EINVAL; num_pages = (param.count + lb_offset + PAGE_SIZE - 1) >> PAGE_SHIFT; /* Allocate the buffers we need */