lkml.org 
[lkml]   [2015]   [Jun]   [16]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 3.4 152/172] spi: spidev: fix possible arithmetic overflow for multi-transfer message
    Date
    From: Ian Abbott <abbotti@mev.co.uk>

    3.4.108-rc1 review patch. If anyone has any objections, please let me know.

    ------------------


    commit f20fbaad7620af2df36a1f9d1c9ecf48ead5b747 upstream.

    `spidev_message()` sums the lengths of the individual SPI transfers to
    determine the overall SPI message length. It restricts the total
    length, returning an error if too long, but it does not check for
    arithmetic overflow. For example, if the SPI message consisted of two
    transfers and the first has a length of 10 and the second has a length
    of (__u32)(-1), the total length would be seen as 9, even though the
    second transfer is actually very long. If the second transfer specifies
    a null `rx_buf` and a non-null `tx_buf`, the `copy_from_user()` could
    overrun the spidev's pre-allocated tx buffer before it reaches an
    invalid user memory address. Fix it by checking that neither the total
    nor the individual transfer lengths exceed the maximum allowed value.

    Thanks to Dan Carpenter for reporting the potential integer overflow.

    Signed-off-by: Ian Abbott <abbotti@mev.co.uk>
    Signed-off-by: Mark Brown <broonie@kernel.org>
    [Ian Abbott: Note: original commit compares the lengths to INT_MAX instead
    of bufsiz due to changes in earlier commits.]
    Signed-off-by: Zefan Li <lizefan@huawei.com>
    ---
    drivers/spi/spidev.c | 5 ++++-
    1 file changed, 4 insertions(+), 1 deletion(-)

    diff --git a/drivers/spi/spidev.c b/drivers/spi/spidev.c
    index 830adbe..1556db9 100644
    --- a/drivers/spi/spidev.c
    +++ b/drivers/spi/spidev.c
    @@ -241,7 +241,10 @@ static int spidev_message(struct spidev_data *spidev,
    k_tmp->len = u_tmp->len;

    total += k_tmp->len;
    - if (total > bufsiz) {
    + /* Check total length of transfers. Also check each
    + * transfer length to avoid arithmetic overflow.
    + */
    + if (total > bufsiz || k_tmp->len > bufsiz) {
    status = -EMSGSIZE;
    goto done;
    }
    --
    1.9.1


    \
     
     \ /
      Last update: 2015-06-16 11:01    [W:8.801 / U:0.020 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site