Patch "tools: iio: iio_generic_buffer: Fix some integer type and calculation" has been added to the 5.10-stable tree

[Sasha Levin <sashal@xxxxxxxxxx>]

This is a note to let you know that I've just added the patch titled

    tools: iio: iio_generic_buffer: Fix some integer type and calculation

to the 5.10-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     tools-iio-iio_generic_buffer-fix-some-integer-type-a.patch
and it can be found in the queue-5.10 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.



commit 9fb65ba5b8b6b048bad575a08b7798861b9b36d6
Author: Chenyuan Mi <michenyuan@xxxxxxxxxx>
Date:   Tue Jul 25 09:24:07 2023 +0000

    tools: iio: iio_generic_buffer: Fix some integer type and calculation
    
    [ Upstream commit 49d736313d0975ddeb156f4f59801da833f78b30 ]
    
    In function size_from_channelarray(), the return value 'bytes' is defined
    as int type. However, the calcution of 'bytes' in this function is designed
    to use the unsigned int type. So it is necessary to change 'bytes' type to
    unsigned int to avoid integer overflow.
    
    The size_from_channelarray() is called in main() function, its return value
    is directly multipled by 'buf_len' and then used as the malloc() parameter.
    The 'buf_len' is completely controllable by user, thus a multiplication
    overflow may occur here. This could allocate an unexpected small area.
    
    Signed-off-by: Chenyuan Mi <michenyuan@xxxxxxxxxx>
    Link: https://lore.kernel.org/r/20230725092407.62545-1-michenyuan@xxxxxxxxxx
    Signed-off-by: Jonathan Cameron <Jonathan.Cameron@xxxxxxxxxx>
    Stable-dep-of: 2d3dff577dd0 ("tools: iio: iio_generic_buffer ensure alignment")
    Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>

diff --git a/tools/iio/iio_generic_buffer.c b/tools/iio/iio_generic_buffer.c
index 7c72405537770..e38c72fd58ccf 100644
--- a/tools/iio/iio_generic_buffer.c
+++ b/tools/iio/iio_generic_buffer.c
@@ -49,9 +49,9 @@ enum autochan {
  * Has the side effect of filling the channels[i].location values used
  * in processing the buffer output.
  **/
-static int size_from_channelarray(struct iio_channel_info *channels, int num_channels)
+static unsigned int size_from_channelarray(struct iio_channel_info *channels, int num_channels)
 {
-	int bytes = 0;
+	unsigned int bytes = 0;
 	int i = 0;
 
 	while (i < num_channels) {
@@ -342,7 +342,7 @@ int main(int argc, char **argv)
 	ssize_t read_size;
 	int dev_num = -1, trig_num = -1;
 	char *buffer_access = NULL;
-	int scan_size;
+	unsigned int scan_size;
 	int noevents = 0;
 	int notrigger = 0;
 	char *dummy;
@@ -612,7 +612,16 @@ int main(int argc, char **argv)
 	}
 
 	scan_size = size_from_channelarray(channels, num_channels);
-	data = malloc(scan_size * buf_len);
+
+	size_t total_buf_len = scan_size * buf_len;
+
+	if (scan_size > 0 && total_buf_len / scan_size != buf_len) {
+		ret = -EFAULT;
+		perror("Integer overflow happened when calculate scan_size * buf_len");
+		goto error;
+	}
+
+	data = malloc(total_buf_len);
 	if (!data) {
 		ret = -ENOMEM;
 		goto error;