[PATCH 1/5 v4] accel/qaic: tighten bounds checking in encode_message()
Jeffrey Hugo
quic_jhugo at quicinc.com
Fri Jul 14 16:02:28 UTC 2023
On 7/14/2023 5:41 AM, Pranjal Ramajor Asha Kanojiya wrote:
>
>
> On 7/11/2023 1:50 PM, Dan Carpenter wrote:
>> There are several issues in this code. The check at the start of the
>> loop:
>>
>> if (user_len >= user_msg->len) {
>>
>> This check does not ensure that we have enough space for the trans_hdr
>> (8 bytes). Instead the check needs to be:
>>
>> if (user_len > user_msg->len - sizeof(*trans_hdr)) {
>>
>> That subtraction is done as an unsigned long we want to avoid
>> negatives. Add a lower bound to the start of the function.
>>
>> if (user_msg->len < sizeof(*trans_hdr))
>>
>> There is a second integer underflow which can happen if
>> trans_hdr->len is zero inside the encode_passthrough() function.
>>
>> memcpy(out_trans->data, in_trans->data, in_trans->hdr.len -
>> sizeof(in_trans->hdr));
>>
>> Instead of adding a check to encode_passthrough() it's better to check
>> in this central place. Add that check:
>>
>> if (trans_hdr->len < sizeof(trans_hdr)
>>
>> The final concern is that the "user_len + trans_hdr->len" might have an
>> integer overflow bug. Use size_add() to prevent that.
>>
>> - if (user_len + trans_hdr->len > user_msg->len) {
>> + if (size_add(user_len, trans_hdr->len) > user_msg->len) {
>>
>> Fixes: 129776ac2e38 ("accel/qaic: Add control path")
>> Signed-off-by: Dan Carpenter <dan.carpenter at linaro.org>
>
> Reviewed-by: Pranjal Ramajor Asha Kanojiya <quic_pkanojiy at quicinc.com>
>
Applied to drm-misc-fixes
-Jeff
More information about the dri-devel
mailing list