queue-4.14/staging-vc04_services-prevent-integer-overflow-in-create_pagelist.patch

   1 From ca641bae6da977d638458e78cd1487b6160a2718 Mon Sep 17 00:00:00 2001
   2 From: Dan Carpenter <dan.carpenter@oracle.com>
   3 Date: Wed, 15 May 2019 12:38:33 +0300
   4 Subject: staging: vc04_services: prevent integer overflow in create_pagelist()
   5
   6 From: Dan Carpenter <dan.carpenter@oracle.com>
   7
   8 commit ca641bae6da977d638458e78cd1487b6160a2718 upstream.
   9
  10 The create_pagelist() "count" parameter comes from the user in
  11 vchiq_ioctl() and it could overflow.  If you look at how create_page()
  12 is called in vchiq_prepare_bulk_data(), then the "size" variable is an
  13 int so it doesn't make sense to allow negatives or larger than INT_MAX.
  14
  15 I don't know this code terribly well, but I believe that typical values
  16 of "count" are typically quite low and I don't think this check will
  17 affect normal valid uses at all.
  18
  19 The "pagelist_size" calculation can also overflow on 32 bit systems, but
  20 not on 64 bit systems.  I have added an integer overflow check for that
  21 as well.
  22
  23 The Raspberry PI doesn't offer the same level of memory protection that
  24 x86 does so these sorts of bugs are probably not super critical to fix.
  25
  26 Fixes: 71bad7f08641 ("staging: add bcm2708 vchiq driver")
  27 Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
  28 Cc: stable <stable@vger.kernel.org>
  29 Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
  30 Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
  31
  32 ---
  33  drivers/staging/vc04_services/interface/vchiq_arm/vchiq_2835_arm.c |    9 +++++++++
  34  1 file changed, 9 insertions(+)
  35
  36 --- a/drivers/staging/vc04_services/interface/vchiq_arm/vchiq_2835_arm.c
  37 +++ b/drivers/staging/vc04_services/interface/vchiq_arm/vchiq_2835_arm.c
  38 @@ -405,9 +405,18 @@ create_pagelist(char __user *buf, size_t
  39         int dma_buffers;
  40         dma_addr_t dma_addr;
  41
  42 +       if (count >= INT_MAX - PAGE_SIZE)
  43 +               return NULL;
  44 +
  45         offset = ((unsigned int)(unsigned long)buf & (PAGE_SIZE - 1));
  46         num_pages = DIV_ROUND_UP(count + offset, PAGE_SIZE);
  47
  48 +       if (num_pages > (SIZE_MAX - sizeof(struct pagelist) -
  49 +                        sizeof(struct vchiq_pagelist_info)) /
  50 +                       (sizeof(u32) + sizeof(pages[0]) +
  51 +                        sizeof(struct scatterlist)))
  52 +               return NULL;
  53 +
  54         pagelist_size = sizeof(PAGELIST_T) +
  55                         (num_pages * sizeof(u32)) +
  56                         (num_pages * sizeof(pages[0]) +