Commit 3b1cc9b9 authored by Sudeep Dutt's avatar Sudeep Dutt Committed by Greg Kroah-Hartman

misc: mic: fix possible signed underflow (undefined behavior) in userspace API

iovcnt is declared as a signed integer in both the userspace API and
as a local variable in mic_virtio.c. The while() loop in mic_virtio.c
iterates until the local variable iovcnt reaches the value 0. If
userspace passes e.g. INT_MIN as iovcnt field, this loop then appears
to depend on an undefined behavior (signed underflow) to complete.
The fix is to use unsigned integers in both the userspace API and
the local variable.

This issue was reported @ https://lkml.org/lkml/2014/1/10/10Reported-by: default avatarMathieu Desnoyers <mathieu.desnoyers@efficios.com>
Reviewed-by: default avatarAshutosh Dixit <ashutosh.dixit@intel.com>
Signed-off-by: default avatarSudeep Dutt <sudeep.dutt@intel.com>
Cc: stable <stable@vger.kernel.org>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent 01ab1167
...@@ -156,7 +156,8 @@ static int mic_vringh_copy(struct mic_vdev *mvdev, struct vringh_kiov *iov, ...@@ -156,7 +156,8 @@ static int mic_vringh_copy(struct mic_vdev *mvdev, struct vringh_kiov *iov,
static int _mic_virtio_copy(struct mic_vdev *mvdev, static int _mic_virtio_copy(struct mic_vdev *mvdev,
struct mic_copy_desc *copy) struct mic_copy_desc *copy)
{ {
int ret = 0, iovcnt = copy->iovcnt; int ret = 0;
u32 iovcnt = copy->iovcnt;
struct iovec iov; struct iovec iov;
struct iovec __user *u_iov = copy->iov; struct iovec __user *u_iov = copy->iov;
void __user *ubuf = NULL; void __user *ubuf = NULL;
......
...@@ -39,7 +39,7 @@ struct mic_copy_desc { ...@@ -39,7 +39,7 @@ struct mic_copy_desc {
#else #else
struct iovec *iov; struct iovec *iov;
#endif #endif
int iovcnt; __u32 iovcnt;
__u8 vr_idx; __u8 vr_idx;
__u8 update_used; __u8 update_used;
__u32 out_len; __u32 out_len;
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment