From patchwork Mon Oct 24 11:31:16 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Greg KH X-Patchwork-Id: 8662 Return-Path: Delivered-To: ouuuleilei@gmail.com Received: by 2002:a5d:6687:0:0:0:0:0 with SMTP id l7csp421796wru; Mon, 24 Oct 2022 05:21:13 -0700 (PDT) X-Google-Smtp-Source: AMsMyM63CQRcP7X1RqYwedV/lZedD+PNOQrwuqL1YsejTCUZF2A+NmzaU2qpWtHVgQuDbXb6pelK X-Received: by 2002:a17:907:6e18:b0:78d:b374:8989 with SMTP id sd24-20020a1709076e1800b0078db3748989mr27265401ejc.552.1666614073055; Mon, 24 Oct 2022 05:21:13 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1666614073; cv=none; d=google.com; s=arc-20160816; b=xHiGEzyHTP7rKTUf9OD5tZeevK5978EVckijip/MOGmJzrkY+MSqE6oJDxJcof39oa DMW0kMCuIBg+ejsjGhCID1A+u70r2Imzn0EbZzm3wGSfD2rKSmFOc3Fwsb1KaLahKWTo Z1U4QkwHF3I1A9q3JuU1acJCWLhbm99f4j0FlrblBtjUHa2Ze6hOjYBV52//UHqJY/m+ QUxPUGBoaIhsjiK3GIJ0XDGt3uoFynpTizC4lMgkHhzLOHpnTT3bhGf6mHvkE2BF92S4 zGzMxZjNb/EWxRMhKTVmUnU4Dvcn4DXZaZdncrtyxYPdUb8TOQ0CgPDVJnXBEQ+fQm6c WwtA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:content-transfer-encoding:mime-version :user-agent:references:in-reply-to:message-id:date:subject:cc:to :from:dkim-signature; bh=bsyKcbIMDeEFw7/nt7KVuwEqlRP5FXUDAoU7kJYZED4=; b=yzzJFiBhki4PfEHkXiSHvLdEGr4mlNTvZbewqqxDqMS3dw3JYG1N3IqRSUq6Es7S/k Bs+2A/Dgi8Me7HlCHvbXfGCmGjUNC590hj2VKirzQ14C7sTjWT4TT7eCVCesRdQzoXfZ trXdAN5qNDgYd7xW4pGLtCKNO95GVHF0LIfOl0FonBUk5HVqk/gBHWBQf59NZZ1iGzCC zlv1109zavEa9bCJfZj9tXIRqgVpUEgzLmDrOTAm7btkldGKOm6P6/TJE4xLeBsbgfjS MaEUKI2onfu+aO6l1a28Q2CzELQ5fJDe2jS2e+vkBwtA/1R3LvYtM2CWiUeHHvxqkDPI Aidg== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@linuxfoundation.org header.s=korg header.b=x5pa6o4x; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linuxfoundation.org Received: from out1.vger.email (out1.vger.email. [2620:137:e000::1:20]) by mx.google.com with ESMTP id sb12-20020a1709076d8c00b00770534b5a71si29532527ejc.858.2022.10.24.05.20.48; Mon, 24 Oct 2022 05:21:13 -0700 (PDT) Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20; Authentication-Results: mx.google.com; dkim=pass header.i=@linuxfoundation.org header.s=korg header.b=x5pa6o4x; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linuxfoundation.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S233079AbiJXMQI (ORCPT + 99 others); Mon, 24 Oct 2022 08:16:08 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:34674 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S233244AbiJXMOc (ORCPT ); Mon, 24 Oct 2022 08:14:32 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 1968E5B071; Mon, 24 Oct 2022 04:55:26 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 89E99612C5; Mon, 24 Oct 2022 11:52:17 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 9F82BC433D6; Mon, 24 Oct 2022 11:52:16 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1666612337; bh=nw7eE55o7Cub4k6OxNnyj+f/jSj2zifMDaD65737OUM=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=x5pa6o4xcJXgFNSixqVhXjX8fMZm/NgErnyveAYqhiigqjS+MrXele+x5dZr9tj44 z0pz0hr19TUtvZwqoCuOTqo0o2LKrUOLwAJLT8iKVQy8Ni/JtacOK5FftlyhsPaRPu pKYvkadJTolV13i2+sp6Q7nGIPF2mb/hQFhq5zpw= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Dan Carpenter , Herbert Xu , Sasha Levin Subject: [PATCH 4.14 159/210] crypto: cavium - prevent integer overflow loading firmware Date: Mon, 24 Oct 2022 13:31:16 +0200 Message-Id: <20221024113002.134861468@linuxfoundation.org> X-Mailer: git-send-email 2.38.1 In-Reply-To: <20221024112956.797777597@linuxfoundation.org> References: <20221024112956.797777597@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 X-Spam-Status: No, score=-7.6 required=5.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,RCVD_IN_DNSWL_HI, SPF_HELO_NONE,SPF_PASS autolearn=ham autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on lindbergh.monkeyblade.net Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org X-getmail-retrieved-from-mailbox: =?utf-8?q?INBOX?= X-GMAIL-THRID: =?utf-8?q?1747571518301643524?= X-GMAIL-MSGID: =?utf-8?q?1747571518301643524?= From: Dan Carpenter [ Upstream commit 2526d6bf27d15054bb0778b2f7bc6625fd934905 ] The "code_length" value comes from the firmware file. If your firmware is untrusted realistically there is probably very little you can do to protect yourself. Still we try to limit the damage as much as possible. Also Smatch marks any data read from the filesystem as untrusted and prints warnings if it not capped correctly. The "ntohl(ucode->code_length) * 2" multiplication can have an integer overflow. Fixes: 9e2c7d99941d ("crypto: cavium - Add Support for Octeon-tx CPT Engine") Signed-off-by: Dan Carpenter Signed-off-by: Herbert Xu Signed-off-by: Sasha Levin --- drivers/crypto/cavium/cpt/cptpf_main.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/drivers/crypto/cavium/cpt/cptpf_main.c b/drivers/crypto/cavium/cpt/cptpf_main.c index 34a6d8bf229e..dc34326e80df 100644 --- a/drivers/crypto/cavium/cpt/cptpf_main.c +++ b/drivers/crypto/cavium/cpt/cptpf_main.c @@ -257,6 +257,7 @@ static int cpt_ucode_load_fw(struct cpt_device *cpt, const u8 *fw, bool is_ae) const struct firmware *fw_entry; struct device *dev = &cpt->pdev->dev; struct ucode_header *ucode; + unsigned int code_length; struct microcode *mcode; int j, ret = 0; @@ -267,11 +268,12 @@ static int cpt_ucode_load_fw(struct cpt_device *cpt, const u8 *fw, bool is_ae) ucode = (struct ucode_header *)fw_entry->data; mcode = &cpt->mcode[cpt->next_mc_idx]; memcpy(mcode->version, (u8 *)fw_entry->data, CPT_UCODE_VERSION_SZ); - mcode->code_size = ntohl(ucode->code_length) * 2; - if (!mcode->code_size) { + code_length = ntohl(ucode->code_length); + if (code_length == 0 || code_length >= INT_MAX / 2) { ret = -EINVAL; goto fw_release; } + mcode->code_size = code_length * 2; mcode->is_ae = is_ae; mcode->core_mask = 0ULL;