From patchwork Wed Oct 19 08:29:52 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Greg KH X-Patchwork-Id: 5113 Return-Path: Delivered-To: ouuuleilei@gmail.com Received: by 2002:a5d:4ac7:0:0:0:0:0 with SMTP id y7csp250894wrs; Wed, 19 Oct 2022 03:50:18 -0700 (PDT) X-Google-Smtp-Source: AMsMyM57ebJyN7YcIBYHDUvoYXMEsnhnsu61V363LzNw4FuiRrWdQyXCdm6ckE+2ltbBO9lOSe2p X-Received: by 2002:a17:906:5dcc:b0:78d:e77d:e66f with SMTP id p12-20020a1709065dcc00b0078de77de66fmr6118483ejv.102.1666176618791; Wed, 19 Oct 2022 03:50:18 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1666176618; cv=none; d=google.com; s=arc-20160816; b=YXKKIGhTCO/kV9535V1Q63ipu03X5liqwc4SGkhaiiMEWaRoBuls22/ifWFlz838Eq JW6VM2/anatJyfGxMXKgqH2HBANAmROigHhM3rOzc9I2zQNOBfjhVgjbkkLChfhfNvta Onqe5P533YOqYYIFM22T6mbVRLA5+yY5ZMAJ5mMTU1U+gxmyV7lKGBf+ACI1NclNYmSB DYpAnkvz10URyCRCKEyELg5vKMuly+aBdT7qukXklJTyFpUnb+TMgKovuJZzDKDjPsgu DgSw/B2QLjX09wEsPApzRLY4/y+7o5qSxrCUzvXSJMjVZLfz/VD9wisSdQCkBFjL5r/j I1CQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:content-transfer-encoding:mime-version :user-agent:references:in-reply-to:message-id:date:subject:cc:to :from:dkim-signature; bh=F19Q5KP4az5kvzkBglTVal7Jq9150LLLbtZoy1+FawQ=; b=rqtlz9V68BXhLQgNLE4Gk1zwFM7xDljSnZDoI2egCF88zYleQi0KXq9yllAxLrcby4 XOfq5v1Bejbdsg07VZ2cA0RiU8sYVJzPQo7NBFoBxUqK1PJaLD809wbtTysHOQMIQFlA jNEQOgA1TYswTkJo1yclSir9CLyuZ8fJZtQqJaptOU7YHx70X1mLNBAQESynnR4/wxfn Xvke77f9JQJkyAj/ngjsEFRMtlHj5Eknf7jHoNqGHyrYWz451Zrnl9TkvEHx/3RauXJ6 zWL40uKQicNuOvU/7o/EpRBcv6ZpqQCtytn6s+ydZXszhGLhccWHXUg71P16ALVSidvN GiYA== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@linuxfoundation.org header.s=korg header.b=XdPWLO8N; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linuxfoundation.org Received: from out1.vger.email (out1.vger.email. [2620:137:e000::1:20]) by mx.google.com with ESMTP id bu3-20020a170906a14300b00782539a0286si11662870ejb.142.2022.10.19.03.49.54; Wed, 19 Oct 2022 03:50:18 -0700 (PDT) Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20; Authentication-Results: mx.google.com; dkim=pass header.i=@linuxfoundation.org header.s=korg header.b=XdPWLO8N; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linuxfoundation.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S234036AbiJSKr6 (ORCPT + 99 others); Wed, 19 Oct 2022 06:47:58 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:40546 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S232947AbiJSKpv (ORCPT ); Wed, 19 Oct 2022 06:45:51 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 6728A11D984; Wed, 19 Oct 2022 03:21:37 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 936CCB82454; Wed, 19 Oct 2022 09:00:44 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id E50F7C433D7; Wed, 19 Oct 2022 09:00:42 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1666170043; bh=qZLcI+C2kMZApJ2J7MvfP6RYfBi+1GyHo4kolVk2Mq4=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=XdPWLO8NskYBrV0Pw7vdMqoiUsDh8cIpRkrQjNOfdbGG3syKKPX85+1FkxHgrsbEZ zVry5oB3oVmO3Mv7iAzHaNbCyM6IdC7wznq/cAr7PND+W39cTxqwPSPN2QVlx8NTfl 7b49AVfi31r7CFyaKyof2MLH5uMDUb7R/59uuWP4= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Dan Carpenter , Xu Yilun , Sasha Levin Subject: [PATCH 6.0 505/862] fpga: prevent integer overflow in dfl_feature_ioctl_set_irq() Date: Wed, 19 Oct 2022 10:29:52 +0200 Message-Id: <20221019083312.305200120@linuxfoundation.org> X-Mailer: git-send-email 2.38.0 In-Reply-To: <20221019083249.951566199@linuxfoundation.org> References: <20221019083249.951566199@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 X-Spam-Status: No, score=-7.4 required=5.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,RCVD_IN_DNSWL_HI, SPF_HELO_NONE,SPF_PASS autolearn=ham autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on lindbergh.monkeyblade.net Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org X-getmail-retrieved-from-mailbox: =?utf-8?q?INBOX?= X-GMAIL-THRID: =?utf-8?q?1747112814171690155?= X-GMAIL-MSGID: =?utf-8?q?1747112814171690155?= From: Dan Carpenter [ Upstream commit 939bc5453b8cbdde9f1e5110ce8309aedb1b501a ] The "hdr.count * sizeof(s32)" multiplication can overflow on 32 bit systems leading to memory corruption. Use array_size() to fix that. Fixes: 322b598be4d9 ("fpga: dfl: introduce interrupt trigger setting API") Signed-off-by: Dan Carpenter Acked-by: Xu Yilun Link: https://lore.kernel.org/r/YxBAtYCM38dM7yzI@kili Signed-off-by: Xu Yilun Signed-off-by: Sasha Levin --- drivers/fpga/dfl.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/fpga/dfl.c b/drivers/fpga/dfl.c index 5498bc337f8b..b9aae85ba930 100644 --- a/drivers/fpga/dfl.c +++ b/drivers/fpga/dfl.c @@ -1866,7 +1866,7 @@ long dfl_feature_ioctl_set_irq(struct platform_device *pdev, return -EINVAL; fds = memdup_user((void __user *)(arg + sizeof(hdr)), - hdr.count * sizeof(s32)); + array_size(hdr.count, sizeof(s32))); if (IS_ERR(fds)) return PTR_ERR(fds);