kernel/linux
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ synced 2026-10-22 19:14:51 +00:00
Code Issues Releases Packages Activity
linux/drivers/tee
History
Jann Horn d9cbf3ac3e tee: Prevent size calculation wraparound on 32-bit kernels 
[ Upstream commit 39bb67edcc ]

The current code around TEE_IOCTL_PARAM_SIZE() is a bit wrong on
32-bit kernels: Multiplying a user-provided 32-bit value with the
size of a structure can wrap around on such platforms.

Fix it by using saturating arithmetic for the size calculation.

This has no security consequences because, in all users of
TEE_IOCTL_PARAM_SIZE(), the subsequent kcalloc() implicitly checks
for wrapping.

Signed-off-by: Jann Horn <jannh@google.com>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>
Tested-by: Rouven Czerwinski <rouven.czerwinski@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
History 2025-06-27 11:07:36 +01:00
..
amdtee tee: amdtee: fix use-after-free vulnerability in amdtee_close_session 2023-10-19 23:08:57 +02:00
optee tee: optee: Fix supplicant wait loop 2025-03-07 16:56:38 +01:00
Kconfig tee: combine "config" and "menu" for TEE's menuconfig 2022-04-05 07:32:23 +02:00
Makefile tee: add AMD-TEE driver 2020-01-04 13:49:51 +08:00
tee_core.c tee: Prevent size calculation wraparound on 32-bit kernels 2025-06-27 11:07:36 +01:00
tee_private.h tee: add tee_shm_register_{user,kernel}_buf() 2022-02-16 07:49:41 +01:00
tee_shm.c tee: fix compiler warning in tee_shm_register() 2022-08-25 11:40:06 +02:00
tee_shm_pool.c tee: refactor TEE_SHM_* flags 2022-02-16 07:49:41 +01:00