lkml.org 
[lkml]   [2011]   [Nov]   [18]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    Date
    From
    Subject[21/26] xen-gntalloc: integer overflow in gntalloc_ioctl_alloc()
    3.0-stable review patch.  If anyone has any objections, please let me know.

    ------------------

    From: Dan Carpenter <dan.carpenter@oracle.com>

    commit 21643e69a4c06f7ef155fbc70e3fba13fba4a756 upstream.

    On 32 bit systems a high value of op.count could lead to an integer
    overflow in the kzalloc() and gref_ids would be smaller than
    expected. If the you triggered another integer overflow in
    "if (gref_size + op.count > limit)" then you'd probably get memory
    corruption inside add_grefs().

    Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
    Signed-off-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

    ---
    drivers/xen/gntalloc.c | 2 +-
    1 file changed, 1 insertion(+), 1 deletion(-)

    --- a/drivers/xen/gntalloc.c
    +++ b/drivers/xen/gntalloc.c
    @@ -280,7 +280,7 @@ static long gntalloc_ioctl_alloc(struct
    goto out;
    }

    - gref_ids = kzalloc(sizeof(gref_ids[0]) * op.count, GFP_TEMPORARY);
    + gref_ids = kcalloc(op.count, sizeof(gref_ids[0]), GFP_TEMPORARY);
    if (!gref_ids) {
    rc = -ENOMEM;
    goto out;



    \
     
     \ /
      Last update: 2011-11-19 01:11    [W:0.018 / U:0.192 seconds]
    ©2003-2016 Jasper Spaans. hosted at Digital OceanAdvertise on this site