queue-4.4/drivers-virt-fsl_hypervisor.c-prevent-integer-overflow-in-ioctl.patch

   1 From 6a024330650e24556b8a18cc654ad00cfecf6c6c Mon Sep 17 00:00:00 2001
   2 From: Dan Carpenter <dan.carpenter@oracle.com>
   3 Date: Tue, 14 May 2019 15:47:03 -0700
   4 Subject: drivers/virt/fsl_hypervisor.c: prevent integer overflow in ioctl
   5
   6 From: Dan Carpenter <dan.carpenter@oracle.com>
   7
   8 commit 6a024330650e24556b8a18cc654ad00cfecf6c6c upstream.
   9
  10 The "param.count" value is a u64 thatcomes from the user.  The code
  11 later in the function assumes that param.count is at least one and if
  12 it's not then it leads to an Oops when we dereference the ZERO_SIZE_PTR.
  13
  14 Also the addition can have an integer overflow which would lead us to
  15 allocate a smaller "pages" array than required.  I can't immediately
  16 tell what the possible run times implications are, but it's safest to
  17 prevent the overflow.
  18
  19 Link: http://lkml.kernel.org/r/20181218082129.GE32567@kadam
  20 Fixes: 6db7199407ca ("drivers/virt: introduce Freescale hypervisor management driver")
  21 Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
  22 Reviewed-by: Andrew Morton <akpm@linux-foundation.org>
  23 Cc: Timur Tabi <timur@freescale.com>
  24 Cc: Mihai Caraman <mihai.caraman@freescale.com>
  25 Cc: Kumar Gala <galak@kernel.crashing.org>
  26 Cc: <stable@vger.kernel.org>
  27 Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
  28 Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
  29 Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
  30
  31 ---
  32  drivers/virt/fsl_hypervisor.c |    3 +++
  33  1 file changed, 3 insertions(+)
  34
  35 --- a/drivers/virt/fsl_hypervisor.c
  36 +++ b/drivers/virt/fsl_hypervisor.c
  37 @@ -215,6 +215,9 @@ static long ioctl_memcpy(struct fsl_hv_i
  38          * hypervisor.
  39          */
  40         lb_offset = param.local_vaddr & (PAGE_SIZE - 1);
  41 +       if (param.count == 0 ||
  42 +           param.count > U64_MAX - lb_offset - PAGE_SIZE + 1)
  43 +               return -EINVAL;
  44         num_pages = (param.count + lb_offset + PAGE_SIZE - 1) >> PAGE_SHIFT;
  45
  46         /* Allocate the buffers we need */