diff mbox

[1/2] misc: pci_endpoint_test: Prevent some integer overflows

Message ID 20170930081552.rm4tjhxcyegpg3vn@mwanda (mailing list archive)
State New, archived
Delegated to: Bjorn Helgaas
Headers show

Commit Message

Dan Carpenter Sept. 30, 2017, 8:15 a.m. UTC 
"size + max" can have an arithmetic overflow when we're allocating:

	orig_src_addr = dma_alloc_coherent(dev, size + alignment, ...

I've added a few checks to prevent that.

Fixes: 13107c60681f ("misc: pci_endpoint_test: Add support to provide aligned buffer addresses")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>

Comments

Bjorn Helgaas Oct. 17, 2017, 6:58 p.m. UTC | #1 
On Sat, Sep 30, 2017 at 11:15:52AM +0300, Dan Carpenter wrote:
> "size + max" can have an arithmetic overflow when we're allocating:
> 
> 	orig_src_addr = dma_alloc_coherent(dev, size + alignment, ...
> 
> I've added a few checks to prevent that.
> 
> Fixes: 13107c60681f ("misc: pci_endpoint_test: Add support to provide aligned buffer addresses")
> Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>

Both applied to pci/endpoint for v4.15, thanks!

Kishon, if you want to ack/nack this, I'll act accordingly.

> diff --git a/drivers/misc/pci_endpoint_test.c b/drivers/misc/pci_endpoint_test.c
> index deb203026496..c0d323077ad0 100644
> --- a/drivers/misc/pci_endpoint_test.c
> +++ b/drivers/misc/pci_endpoint_test.c
> @@ -226,6 +226,9 @@ static bool pci_endpoint_test_copy(struct pci_endpoint_test *test, size_t size)
>  	u32 src_crc32;
>  	u32 dst_crc32;
>  
> +	if (size > SIZE_MAX - alignment)
> +		goto err;
> +
>  	orig_src_addr = dma_alloc_coherent(dev, size + alignment,
>  					   &orig_src_phys_addr, GFP_KERNEL);
>  	if (!orig_src_addr) {
> @@ -311,6 +314,9 @@ static bool pci_endpoint_test_write(struct pci_endpoint_test *test, size_t size)
>  	size_t alignment = test->alignment;
>  	u32 crc32;
>  
> +	if (size > SIZE_MAX - alignment)
> +		goto err;
> +
>  	orig_addr = dma_alloc_coherent(dev, size + alignment, &orig_phys_addr,
>  				       GFP_KERNEL);
>  	if (!orig_addr) {
> @@ -369,6 +375,9 @@ static bool pci_endpoint_test_read(struct pci_endpoint_test *test, size_t size)
>  	size_t alignment = test->alignment;
>  	u32 crc32;
>  
> +	if (size > SIZE_MAX - alignment)
> +		goto err;
> +
>  	orig_addr = dma_alloc_coherent(dev, size + alignment, &orig_phys_addr,
>  				       GFP_KERNEL);
>  	if (!orig_addr) {
Kishon Vijay Abraham I Oct. 31, 2017, 6:53 a.m. UTC | #2 
On Wednesday 18 October 2017 12:28 AM, Bjorn Helgaas wrote:
> On Sat, Sep 30, 2017 at 11:15:52AM +0300, Dan Carpenter wrote:
>> "size + max" can have an arithmetic overflow when we're allocating:
>>
>> 	orig_src_addr = dma_alloc_coherent(dev, size + alignment, ...
>>
>> I've added a few checks to prevent that.
>>
>> Fixes: 13107c60681f ("misc: pci_endpoint_test: Add support to provide aligned buffer addresses")
>> Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
> 
> Both applied to pci/endpoint for v4.15, thanks!
> 
> Kishon, if you want to ack/nack this, I'll act accordingly.

patch looks correct
Acked-by: Kishon Vijay Abraham I <kishon@ti.com>
> 
>> diff --git a/drivers/misc/pci_endpoint_test.c b/drivers/misc/pci_endpoint_test.c
>> index deb203026496..c0d323077ad0 100644
>> --- a/drivers/misc/pci_endpoint_test.c
>> +++ b/drivers/misc/pci_endpoint_test.c
>> @@ -226,6 +226,9 @@ static bool pci_endpoint_test_copy(struct pci_endpoint_test *test, size_t size)
>>  	u32 src_crc32;
>>  	u32 dst_crc32;
>>  
>> +	if (size > SIZE_MAX - alignment)
>> +		goto err;
>> +
>>  	orig_src_addr = dma_alloc_coherent(dev, size + alignment,
>>  					   &orig_src_phys_addr, GFP_KERNEL);
>>  	if (!orig_src_addr) {
>> @@ -311,6 +314,9 @@ static bool pci_endpoint_test_write(struct pci_endpoint_test *test, size_t size)
>>  	size_t alignment = test->alignment;
>>  	u32 crc32;
>>  
>> +	if (size > SIZE_MAX - alignment)
>> +		goto err;
>> +
>>  	orig_addr = dma_alloc_coherent(dev, size + alignment, &orig_phys_addr,
>>  				       GFP_KERNEL);
>>  	if (!orig_addr) {
>> @@ -369,6 +375,9 @@ static bool pci_endpoint_test_read(struct pci_endpoint_test *test, size_t size)
>>  	size_t alignment = test->alignment;
>>  	u32 crc32;
>>  
>> +	if (size > SIZE_MAX - alignment)
>> +		goto err;
>> +
>>  	orig_addr = dma_alloc_coherent(dev, size + alignment, &orig_phys_addr,
>>  				       GFP_KERNEL);
>>  	if (!orig_addr) {
diff mbox

Patch

diff --git a/drivers/misc/pci_endpoint_test.c b/drivers/misc/pci_endpoint_test.c
index deb203026496..c0d323077ad0 100644
--- a/drivers/misc/pci_endpoint_test.c
+++ b/drivers/misc/pci_endpoint_test.c
@@ -226,6 +226,9 @@  static bool pci_endpoint_test_copy(struct pci_endpoint_test *test, size_t size)
 	u32 src_crc32;
 	u32 dst_crc32;
 
+	if (size > SIZE_MAX - alignment)
+		goto err;
+
 	orig_src_addr = dma_alloc_coherent(dev, size + alignment,
 					   &orig_src_phys_addr, GFP_KERNEL);
 	if (!orig_src_addr) {
@@ -311,6 +314,9 @@  static bool pci_endpoint_test_write(struct pci_endpoint_test *test, size_t size)
 	size_t alignment = test->alignment;
 	u32 crc32;
 
+	if (size > SIZE_MAX - alignment)
+		goto err;
+
 	orig_addr = dma_alloc_coherent(dev, size + alignment, &orig_phys_addr,
 				       GFP_KERNEL);
 	if (!orig_addr) {
@@ -369,6 +375,9 @@  static bool pci_endpoint_test_read(struct pci_endpoint_test *test, size_t size)
 	size_t alignment = test->alignment;
 	u32 crc32;
 
+	if (size > SIZE_MAX - alignment)
+		goto err;
+
 	orig_addr = dma_alloc_coherent(dev, size + alignment, &orig_phys_addr,
 				       GFP_KERNEL);
 	if (!orig_addr) {