Re: [PATCH v2] udmabuf: Fix a potential (and unlikely) access to unallocated memory

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 





On 2/18/24 11:46, Christophe JAILLET wrote:
If 'list_limit' is set to a very high value, 'lsize' computation could
overflow if 'head.count' is big enough.

In such a case, udmabuf_create() would access to memory beyond 'list'.

Use memdup_array_user() which checks for overflow.

While at it, include <linux/string.h>.

Fixes: fbb0de795078 ("Add udmabuf misc device")'

I don't think this tag is needed in this case.

Also, please, CC linux-hardening next time.

Signed-off-by: Christophe JAILLET <christophe.jaillet@xxxxxxxxxx>

In any case, LGTM:

Reviewed-by: Gustavo A. R. Silva <gustavoars@xxxxxxxxxx>

Thanks!
--
Gustavo

---
v2: - Use memdup_array_user()   [Kees Cook]
     - Use sizeof(*list)   [Gustavo A. R. Silva]
     - Add include <linux/string.h>

v1: https://lore.kernel.org/all/3e37f05c7593f1016f0a46de188b3357cbbd0c0b.1695060389.git.christophe.jaillet@xxxxxxxxxx/

Signed-off-by: Christophe JAILLET <christophe.jaillet@xxxxxxxxxx>
---
  drivers/dma-buf/udmabuf.c | 6 +++---
  1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/drivers/dma-buf/udmabuf.c b/drivers/dma-buf/udmabuf.c
index c40645999648..5728948ea6f2 100644
--- a/drivers/dma-buf/udmabuf.c
+++ b/drivers/dma-buf/udmabuf.c
@@ -11,6 +11,7 @@
  #include <linux/module.h>
  #include <linux/shmem_fs.h>
  #include <linux/slab.h>
+#include <linux/string.h>
  #include <linux/udmabuf.h>
  #include <linux/vmalloc.h>
  #include <linux/iosys-map.h>
@@ -314,14 +315,13 @@ static long udmabuf_ioctl_create_list(struct file *filp, unsigned long arg)
  	struct udmabuf_create_list head;
  	struct udmabuf_create_item *list;
  	int ret = -EINVAL;
-	u32 lsize;
if (copy_from_user(&head, (void __user *)arg, sizeof(head)))
  		return -EFAULT;
  	if (head.count > list_limit)
  		return -EINVAL;
-	lsize = sizeof(struct udmabuf_create_item) * head.count;
-	list = memdup_user((void __user *)(arg + sizeof(head)), lsize);
+	list = memdup_array_user((void __user *)(arg + sizeof(head)),
+				 sizeof(*list), head.count);
  	if (IS_ERR(list))
  		return PTR_ERR(list);



[Index of Archives]     [Linux DRI Users]     [Linux Intel Graphics]     [Linux USB Devel]     [Video for Linux]     [Linux Audio Users]     [Yosemite News]     [Linux Kernel]     [Linux SCSI]     [XFree86]     [Linux USB Devel]     [Video for Linux]     [Linux Audio Users]     [Linux Kernel]     [Linux SCSI]     [XFree86]
  Powered by Linux