lkml.org 
[lkml]   [2022]   [Dec]   [17]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH AUTOSEL 6.1 17/22] acct: fix potential integer overflow in encode_comp_t()
    Date
    From: Zheng Yejian <zhengyejian1@huawei.com>

    [ Upstream commit c5f31c655bcc01b6da53b836ac951c1556245305 ]

    The integer overflow is descripted with following codes:
    > 317 static comp_t encode_comp_t(u64 value)
    > 318 {
    > 319 int exp, rnd;
    ......
    > 341 exp <<= MANTSIZE;
    > 342 exp += value;
    > 343 return exp;
    > 344 }

    Currently comp_t is defined as type of '__u16', but the variable 'exp' is
    type of 'int', so overflow would happen when variable 'exp' in line 343 is
    greater than 65535.

    Link: https://lkml.kernel.org/r/20210515140631.369106-3-zhengyejian1@huawei.com
    Signed-off-by: Zheng Yejian <zhengyejian1@huawei.com>
    Cc: Hanjun Guo <guohanjun@huawei.com>
    Cc: Randy Dunlap <rdunlap@infradead.org>
    Cc: Vlastimil Babka <vbabka@suse.cz>
    Cc: Zhang Jinhao <zhangjinhao2@huawei.com>
    Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>
    ---
    kernel/acct.c | 2 ++
    1 file changed, 2 insertions(+)

    diff --git a/kernel/acct.c b/kernel/acct.c
    index 62200d799b9b..034a26daabb2 100644
    --- a/kernel/acct.c
    +++ b/kernel/acct.c
    @@ -350,6 +350,8 @@ static comp_t encode_comp_t(unsigned long value)
    exp++;
    }

    + if (exp > (((comp_t) ~0U) >> MANTSIZE))
    + return (comp_t) ~0U;
    /*
    * Clean it up and polish it off.
    */
    --
    2.35.1
    \
     
     \ /
      Last update: 2022-12-17 16:30    [W:4.816 / U:0.116 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site