lkml.org 
[lkml]   [2018]   [Apr]   [11]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 4.4 015/190] drivers/misc/vmw_vmci/vmci_queue_pair.c: fix a couple integer overflow tests
    Date
    4.4-stable review patch.  If anyone has any objections, please let me know.

    ------------------

    From: Dan Carpenter <dan.carpenter@oracle.com>


    [ Upstream commit 146180c052a00172f4dc08eaade836fd02f61fb5 ]

    The "DIV_ROUND_UP(size, PAGE_SIZE)" operation can overflow if "size" is
    more than ULLONG_MAX - PAGE_SIZE.

    Link: http://lkml.kernel.org/r/20170322111950.GA11279@mwanda
    Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
    Cc: Jorgen Hansen <jhansen@vmware.com>
    Cc: Masahiro Yamada <yamada.masahiro@socionext.com>
    Cc: Michal Hocko <mhocko@suse.com>
    Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
    Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    ---
    drivers/misc/vmw_vmci/vmci_queue_pair.c | 10 ++++++++--
    1 file changed, 8 insertions(+), 2 deletions(-)

    --- a/drivers/misc/vmw_vmci/vmci_queue_pair.c
    +++ b/drivers/misc/vmw_vmci/vmci_queue_pair.c
    @@ -298,8 +298,11 @@ static void *qp_alloc_queue(u64 size, u3
    size_t pas_size;
    size_t vas_size;
    size_t queue_size = sizeof(*queue) + sizeof(*queue->kernel_if);
    - const u64 num_pages = DIV_ROUND_UP(size, PAGE_SIZE) + 1;
    + u64 num_pages;

    + if (size > SIZE_MAX - PAGE_SIZE)
    + return NULL;
    + num_pages = DIV_ROUND_UP(size, PAGE_SIZE) + 1;
    if (num_pages >
    (SIZE_MAX - queue_size) /
    (sizeof(*queue->kernel_if->u.g.pas) +
    @@ -624,9 +627,12 @@ static struct vmci_queue *qp_host_alloc_
    {
    struct vmci_queue *queue;
    size_t queue_page_size;
    - const u64 num_pages = DIV_ROUND_UP(size, PAGE_SIZE) + 1;
    + u64 num_pages;
    const size_t queue_size = sizeof(*queue) + sizeof(*(queue->kernel_if));

    + if (size > SIZE_MAX - PAGE_SIZE)
    + return NULL;
    + num_pages = DIV_ROUND_UP(size, PAGE_SIZE) + 1;
    if (num_pages > (SIZE_MAX - queue_size) /
    sizeof(*queue->kernel_if->u.h.page))
    return NULL;

    \
     
     \ /
      Last update: 2018-04-11 23:00    [W:2.879 / U:0.112 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site