From patchwork Sat Oct 22 07:26:51 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Greg KH X-Patchwork-Id: 7589 Return-Path: Delivered-To: ouuuleilei@gmail.com Received: by 2002:a5d:4242:0:0:0:0:0 with SMTP id s2csp1106332wrr; Sat, 22 Oct 2022 01:37:31 -0700 (PDT) X-Google-Smtp-Source: AMsMyM4ne1pTS51H6sdmiQGuuoXqkyOhFdmj/G/FauEzZ1qok1R5pWWkFIU096kBGnTe4iYD35dg X-Received: by 2002:a17:903:2442:b0:17f:8069:533a with SMTP id l2-20020a170903244200b0017f8069533amr22927348pls.46.1666427851654; Sat, 22 Oct 2022 01:37:31 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1666427851; cv=none; d=google.com; s=arc-20160816; b=xLbWe7atXcT8UoVs1oYQl5xzEyuwGqMmi09dshMT+wa8IEFvFjxVzcmbY945FXa8/F FtUXX0RIo6xGzsw3Pkiev0/P6YZ9iPxYj4dufsbbLR/eGXFyMyUg4iiU4GJXF3P2/f3B HlPbTKDHeHOVYx38q9Fi836r/II/0u03XCjRJKxfJKvAFClOZEfgDRUBareiPrcKjXC+ 7YoRQXjmeF4osJ4W8jG1N1+BWqyxGZ+tVXJM8kxArBJvbwLxpZUl/zYv1WSVsShDp+JW MHrut8u58B7psniIZDKMaoXoFhNiMhrV4OjmQ5sZWU7YpyIj0ldXuid0ViVDlkpOmNZ8 qryA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:content-transfer-encoding:mime-version :user-agent:references:in-reply-to:message-id:date:subject:cc:to :from:dkim-signature; bh=hJv7IUM6kJVsPIVNE+HRCOwEHEJ86PcnO/llMYLz+4M=; b=0LS6ZjYs0RAP9xk7pjHEZfZwlhJWoXm36tPvBHWgTfCG1hh0nVW0OQ43FnVYo2Hlmi eP1JHU1zam1QkbS3KffyzC8Fk3w2Z8xUucd66kf/WIfay59Xvaz0DAFzQJ2HO/k5ukb7 2BoTe81b87IHAVazDkMC4nc9tnt/OrulkghV/FaH1Zrr0kI+5hgxX+y4oa4KyQj9Uhlc mHi043Md7wo5nHIOBL8rAhXlHkcIa3VVtpqwvU33tHsVgDKSJ9l29RmkNaM+KttLJ7JD l70qoEzsyw3ZfEiRE6YPTijSkwWdRe+8SJ2yt2kPiYBOz335OCnTJfNU3kcmVNBN3PAZ 3lhA== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@linuxfoundation.org header.s=korg header.b=qDDvXkD3; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linuxfoundation.org Received: from out1.vger.email (out1.vger.email. [2620:137:e000::1:20]) by mx.google.com with ESMTP id 189-20020a6306c6000000b0046ec3ee4fafsi3993221pgg.211.2022.10.22.01.37.17; Sat, 22 Oct 2022 01:37:31 -0700 (PDT) Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20; Authentication-Results: mx.google.com; dkim=pass header.i=@linuxfoundation.org header.s=korg header.b=qDDvXkD3; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linuxfoundation.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S233727AbiJVIWx (ORCPT + 99 others); Sat, 22 Oct 2022 04:22:53 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:51514 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S233722AbiJVIU5 (ORCPT ); Sat, 22 Oct 2022 04:20:57 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 91C742DF477; Sat, 22 Oct 2022 00:58:51 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 33CCA60B09; Sat, 22 Oct 2022 07:58:51 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 09389C433D6; Sat, 22 Oct 2022 07:58:49 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1666425530; bh=R5xFzSHogEP2NN2e/wL2tnIj+3tgTrpSBrWmiZXApdA=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=qDDvXkD3EYzjQnMXli79oI7yzOSToyeiAF9jYXsdsfwMdtFDTqkLDrxw5NoLGRqyg Yd6QLOTfcs0j1mA5hxiYhoyl04NqtP9GoALw9IH17dTN+apZvihFeGIASm8l8pHlzy iPOwiGxoI6/6Xj4ZBSnCbYJwAyY6Ss+HwVRwLuac= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Dan Carpenter , Herbert Xu , Sasha Levin Subject: [PATCH 5.19 532/717] crypto: cavium - prevent integer overflow loading firmware Date: Sat, 22 Oct 2022 09:26:51 +0200 Message-Id: <20221022072521.848741405@linuxfoundation.org> X-Mailer: git-send-email 2.38.1 In-Reply-To: <20221022072415.034382448@linuxfoundation.org> References: <20221022072415.034382448@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 X-Spam-Status: No, score=-7.3 required=5.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,RCVD_IN_DNSWL_HI, SPF_HELO_NONE,SPF_PASS autolearn=ham autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on lindbergh.monkeyblade.net Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org X-getmail-retrieved-from-mailbox: =?utf-8?q?INBOX?= X-GMAIL-THRID: =?utf-8?q?1747376250989094820?= X-GMAIL-MSGID: =?utf-8?q?1747376250989094820?= From: Dan Carpenter [ Upstream commit 2526d6bf27d15054bb0778b2f7bc6625fd934905 ] The "code_length" value comes from the firmware file. If your firmware is untrusted realistically there is probably very little you can do to protect yourself. Still we try to limit the damage as much as possible. Also Smatch marks any data read from the filesystem as untrusted and prints warnings if it not capped correctly. The "ntohl(ucode->code_length) * 2" multiplication can have an integer overflow. Fixes: 9e2c7d99941d ("crypto: cavium - Add Support for Octeon-tx CPT Engine") Signed-off-by: Dan Carpenter Signed-off-by: Herbert Xu Signed-off-by: Sasha Levin --- drivers/crypto/cavium/cpt/cptpf_main.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/drivers/crypto/cavium/cpt/cptpf_main.c b/drivers/crypto/cavium/cpt/cptpf_main.c index 8c32d0eb8fcf..6872ac344001 100644 --- a/drivers/crypto/cavium/cpt/cptpf_main.c +++ b/drivers/crypto/cavium/cpt/cptpf_main.c @@ -253,6 +253,7 @@ static int cpt_ucode_load_fw(struct cpt_device *cpt, const u8 *fw, bool is_ae) const struct firmware *fw_entry; struct device *dev = &cpt->pdev->dev; struct ucode_header *ucode; + unsigned int code_length; struct microcode *mcode; int j, ret = 0; @@ -263,11 +264,12 @@ static int cpt_ucode_load_fw(struct cpt_device *cpt, const u8 *fw, bool is_ae) ucode = (struct ucode_header *)fw_entry->data; mcode = &cpt->mcode[cpt->next_mc_idx]; memcpy(mcode->version, (u8 *)fw_entry->data, CPT_UCODE_VERSION_SZ); - mcode->code_size = ntohl(ucode->code_length) * 2; - if (!mcode->code_size) { + code_length = ntohl(ucode->code_length); + if (code_length == 0 || code_length >= INT_MAX / 2) { ret = -EINVAL; goto fw_release; } + mcode->code_size = code_length * 2; mcode->is_ae = is_ae; mcode->core_mask = 0ULL;