From patchwork Mon Oct 24 11:31:33 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Greg KH X-Patchwork-Id: 8964 Return-Path: Delivered-To: ouuuleilei@gmail.com Received: by 2002:a5d:6687:0:0:0:0:0 with SMTP id l7csp436860wru; Mon, 24 Oct 2022 05:58:18 -0700 (PDT) X-Google-Smtp-Source: AMsMyM5HQ7exBm+sPeP/e8YDy8Oa9pAb0TevQnTWgHcsJihYQO7zecAhUHhCmPrje3Ic6iJ2zCfH X-Received: by 2002:a17:90b:224d:b0:20d:8828:3051 with SMTP id hk13-20020a17090b224d00b0020d88283051mr37507103pjb.89.1666616297985; Mon, 24 Oct 2022 05:58:17 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1666616297; cv=none; d=google.com; s=arc-20160816; b=shUz2iLGK9Pqp3fhbNWjjYGn+NoJq29CY+eC1nIj3jRLWiA9HM34kAaIdfjv8sNNMT uj2M7bkOjXt+3OlRDSEXlPr8R0ZmiLxUTbQcwiGaURGS06w4PmOg4D5APU7FlJ6x/xiB j/jVJRS+BK/k+k3j7DgQVgXVXhjEX62YwxXqwvc2rNM8G1rXQjbnoWHedflPwLDKd5JY RE0wGX+mO9xrXoZ84agQIHA3SaOZhtF38zkVoCPnYq6hkwFwupqceqt4BHnaQ1/JLYNo 0SyjU44/B/CTrB2gB0QyU2iYR3mvPx2HRRnKE1ny55RDIdYXB/vgBZ43SaIDS/8n7isc nqmQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:content-transfer-encoding:mime-version :user-agent:references:in-reply-to:message-id:date:subject:cc:to :from:dkim-signature; bh=DezC5LGKrTDiOt0yXtY3YAJjtyteT3YP8A2HwWPs8qU=; b=nwdgTzSX0PGy3u72VcSfGRajh/YAsgVQoo6IWgwGUmTkc4VUXEwTYhJn8MAGawSDdh EMtEf9pxqnn4DU8QMNv8nkFdhMLqwOaiDz7Cv7VC9ZHJVrOIkpz4NKfJAwxmdV54rTZi AnH+2SUBBwoWQbgcknbaLG1gfs7BkXvU9Z6qKSqSpRIV6G6st4pWSzMBlpMvo5Tceher B5ODXVmmtomOKOlqKWmE0uiuG6sr5a0Xm/BwfQi/3xKc6w2I87DjZxltDiOsc6m+cvlP meuY++oJX5V7yCYF37MLEGYMjU5wHQ3MC395U6ugCuka32eIRBuaBJf4TRNOwIsDwhpk AbvQ== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@linuxfoundation.org header.s=korg header.b=qgDmtZSo; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linuxfoundation.org Received: from out1.vger.email (out1.vger.email. [2620:137:e000::1:20]) by mx.google.com with ESMTP id ls9-20020a17090b350900b00213255221e3si1486917pjb.1.2022.10.24.05.58.04; Mon, 24 Oct 2022 05:58:17 -0700 (PDT) Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20; Authentication-Results: mx.google.com; dkim=pass header.i=@linuxfoundation.org header.s=korg header.b=qgDmtZSo; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linuxfoundation.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S234797AbiJXM5a (ORCPT + 99 others); Mon, 24 Oct 2022 08:57:30 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:41054 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S234369AbiJXM5I (ORCPT ); Mon, 24 Oct 2022 08:57:08 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id A789557E1D; Mon, 24 Oct 2022 05:16:28 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id B5AE4612C3; Mon, 24 Oct 2022 12:12:43 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id CCDCCC433C1; Mon, 24 Oct 2022 12:12:42 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1666613563; bh=afOYIS3FPYL4NSLiTIHXXLe3RlmHLDq9fyBIsk/Z1Ew=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=qgDmtZSo3UvobIAZcREQrAg2VEHgt6X0kHa5Nh6oAjjHi6yB5Qdtc0VVCpKL5IVd7 q/TmwNr5TEBdT43MnjjLiPipY1PxFvzxdJJ1W4SlS1Dikhau/noUEzJjXSjGXL2p5c C1ZyE7QKVBjrlgeSaEFaljWDwI0IrzE02Sik97DQ= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Dan Carpenter , Herbert Xu , Sasha Levin Subject: [PATCH 5.4 183/255] crypto: cavium - prevent integer overflow loading firmware Date: Mon, 24 Oct 2022 13:31:33 +0200 Message-Id: <20221024113008.979725077@linuxfoundation.org> X-Mailer: git-send-email 2.38.1 In-Reply-To: <20221024113002.471093005@linuxfoundation.org> References: <20221024113002.471093005@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 X-Spam-Status: No, score=-7.6 required=5.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,RCVD_IN_DNSWL_HI, SPF_HELO_NONE,SPF_PASS autolearn=ham autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on lindbergh.monkeyblade.net Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org X-getmail-retrieved-from-mailbox: =?utf-8?q?INBOX?= X-GMAIL-THRID: =?utf-8?q?1747573850827982349?= X-GMAIL-MSGID: =?utf-8?q?1747573850827982349?= From: Dan Carpenter [ Upstream commit 2526d6bf27d15054bb0778b2f7bc6625fd934905 ] The "code_length" value comes from the firmware file. If your firmware is untrusted realistically there is probably very little you can do to protect yourself. Still we try to limit the damage as much as possible. Also Smatch marks any data read from the filesystem as untrusted and prints warnings if it not capped correctly. The "ntohl(ucode->code_length) * 2" multiplication can have an integer overflow. Fixes: 9e2c7d99941d ("crypto: cavium - Add Support for Octeon-tx CPT Engine") Signed-off-by: Dan Carpenter Signed-off-by: Herbert Xu Signed-off-by: Sasha Levin --- drivers/crypto/cavium/cpt/cptpf_main.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/drivers/crypto/cavium/cpt/cptpf_main.c b/drivers/crypto/cavium/cpt/cptpf_main.c index 781949027451..d9362199423f 100644 --- a/drivers/crypto/cavium/cpt/cptpf_main.c +++ b/drivers/crypto/cavium/cpt/cptpf_main.c @@ -254,6 +254,7 @@ static int cpt_ucode_load_fw(struct cpt_device *cpt, const u8 *fw, bool is_ae) const struct firmware *fw_entry; struct device *dev = &cpt->pdev->dev; struct ucode_header *ucode; + unsigned int code_length; struct microcode *mcode; int j, ret = 0; @@ -264,11 +265,12 @@ static int cpt_ucode_load_fw(struct cpt_device *cpt, const u8 *fw, bool is_ae) ucode = (struct ucode_header *)fw_entry->data; mcode = &cpt->mcode[cpt->next_mc_idx]; memcpy(mcode->version, (u8 *)fw_entry->data, CPT_UCODE_VERSION_SZ); - mcode->code_size = ntohl(ucode->code_length) * 2; - if (!mcode->code_size) { + code_length = ntohl(ucode->code_length); + if (code_length == 0 || code_length >= INT_MAX / 2) { ret = -EINVAL; goto fw_release; } + mcode->code_size = code_length * 2; mcode->is_ae = is_ae; mcode->core_mask = 0ULL;