linux-kernel - [PATCH 6/6] lib/scatterlist: Fix overflow check in sgl_alloc

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Wed, 26 Sep 2018 15:16:25 +0100
From:   Tvrtko Ursulin <tursulin@...ulin.net>
To:     linux-kernel@...r.kernel.org
Cc:     tursulin@...ulin.net, tvrtko.ursulin@...ux.intel.com,
        Tvrtko Ursulin <tvrtko.ursulin@...el.com>,
        Bart Van Assche <bart.vanassche@....com>,
        Hannes Reinecke <hare@...e.com>,
        Johannes Thumshirn <jthumshirn@...e.de>,
        Jens Axboe <axboe@...nel.dk>
Subject: [PATCH 6/6] lib/scatterlist: Fix overflow check in sgl_alloc_order

From: Tvrtko Ursulin <tvrtko.ursulin@...el.com>

It is necessary to ensure types on both sides of the comparison are of the
same width. Otherwise the check overflows sooner than expect due left hand
side being an unsigned long length, and the right hand side unsigned int
number of elements multiplied by element size.

Signed-off-by: Tvrtko Ursulin <tvrtko.ursulin@...el.com>
Cc: Bart Van Assche <bart.vanassche@....com>
Cc: Hannes Reinecke <hare@...e.com>
Cc: Johannes Thumshirn <jthumshirn@...e.de>
Cc: Jens Axboe <axboe@...nel.dk>
---
 lib/scatterlist.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/scatterlist.c b/lib/scatterlist.c
index 581a2e91e515..c87243d46f10 100644
--- a/lib/scatterlist.c
+++ b/lib/scatterlist.c
@@ -485,7 +485,7 @@ struct scatterlist *sgl_alloc_order(unsigned long length, unsigned int order,
 
 	nent = round_up(length, PAGE_SIZE << order) >> (PAGE_SHIFT + order);
 	/* Check for integer overflow */
-	if (length > (nent << (PAGE_SHIFT + order)))
+	if (length > ((unsigned long)nent << (PAGE_SHIFT + order)))
 		return NULL;
 	nalloc = nent;
 	if (chainable) {
-- 
2.17.1