Patch "pstore: ram_core: fix possible overflow in persistent_ram_init_ecc()" has been added to the 6.7-stable tree

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



This is a note to let you know that I've just added the patch titled

    pstore: ram_core: fix possible overflow in persistent_ram_init_ecc()

to the 6.7-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     pstore-ram_core-fix-possible-overflow-in-persistent_.patch
and it can be found in the queue-6.7 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.



commit 0d4995acf67c774e8950270997d6e30ce59e964b
Author: Sergey Shtylyov <s.shtylyov@xxxxxx>
Date:   Sun Nov 5 23:29:36 2023 +0300

    pstore: ram_core: fix possible overflow in persistent_ram_init_ecc()
    
    [ Upstream commit 86222a8fc16ec517de8da2604d904c9df3a08e5d ]
    
    In persistent_ram_init_ecc(), on 64-bit arches DIV_ROUND_UP() will return
    64-bit value since persistent_ram_zone::buffer_size has type size_t which
    is derived from the 64-bit *unsigned long*, while the ecc_blocks variable
    this value gets assigned to has (always 32-bit) *int* type.  Even if that
    value fits into *int* type, an overflow is still possible when calculating
    the size_t typed ecc_total variable further below since there's no cast to
    any 64-bit type before multiplication.  Declaring the ecc_blocks variable
    as *size_t* should fix this mess...
    
    Found by Linux Verification Center (linuxtesting.org) with the SVACE static
    analysis tool.
    
    Fixes: 9cc05ad97c57 ("staging: android: persistent_ram: refactor ecc support")
    Signed-off-by: Sergey Shtylyov <s.shtylyov@xxxxxx>
    Link: https://lore.kernel.org/r/20231105202936.25694-1-s.shtylyov@xxxxxx
    Signed-off-by: Kees Cook <keescook@xxxxxxxxxxxx>
    Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>

diff --git a/fs/pstore/ram_core.c b/fs/pstore/ram_core.c
index 650e437b55e6..f1848cdd6d34 100644
--- a/fs/pstore/ram_core.c
+++ b/fs/pstore/ram_core.c
@@ -190,7 +190,7 @@ static int persistent_ram_init_ecc(struct persistent_ram_zone *prz,
 {
 	int numerr;
 	struct persistent_ram_buffer *buffer = prz->buffer;
-	int ecc_blocks;
+	size_t ecc_blocks;
 	size_t ecc_total;
 
 	if (!ecc_info || !ecc_info->ecc_size)




[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Index of Archives]     [Linux USB Devel]     [Linux Audio Users]     [Yosemite News]     [Linux Kernel]     [Linux SCSI]

  Powered by Linux