kernel/linux
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ synced 2026-10-16 22:39:48 +00:00
Code Issues Releases Packages Activity
linux/drivers/virt
History
Dan Carpenter bfa8c73482 drivers/virt/fsl_hypervisor.c: prevent integer overflow in ioctl 
commit 6a02433065 upstream.

The "param.count" value is a u64 thatcomes from the user.  The code
later in the function assumes that param.count is at least one and if
it's not then it leads to an Oops when we dereference the ZERO_SIZE_PTR.

Also the addition can have an integer overflow which would lead us to
allocate a smaller "pages" array than required.  I can't immediately
tell what the possible run times implications are, but it's safest to
prevent the overflow.

Link: http://lkml.kernel.org/r/20181218082129.GE32567@kadam
Fixes: 6db7199407 ("drivers/virt: introduce Freescale hypervisor management driver")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Reviewed-by: Andrew Morton <akpm@linux-foundation.org>
Cc: Timur Tabi <timur@freescale.com>
Cc: Mihai Caraman <mihai.caraman@freescale.com>
Cc: Kumar Gala <galak@kernel.crashing.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
History 2019-06-20 18:11:26 +01:00
..
fsl_hypervisor.c drivers/virt/fsl_hypervisor.c: prevent integer overflow in ioctl 2019-06-20 18:11:26 +01:00
Kconfig PPC: select EPAPR_PARAVIRT for all users of epapr hcalls 2012-10-05 23:38:37 +02:00
Makefile drivers/virt: introduce Freescale hypervisor management driver 2011-07-08 00:21:27 -05:00