linux-kernel - Re: [PATCH AUTOSEL 5.5 346/542] driver core: platform: Prevent resouce overflow from causing infinite loops

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Fri, 14 Feb 2020 16:49:35 -0500
From:   Greg Kroah-Hartman <gregkh@...uxfoundation.org>
To:     Sasha Levin <sashal@...nel.org>
Cc:     linux-kernel@...r.kernel.org, stable@...r.kernel.org,
        Simon Schwartz <kern.simon@...schwartz.xyz>
Subject: Re: [PATCH AUTOSEL 5.5 346/542] driver core: platform: Prevent
 resouce overflow from causing infinite loops

On Fri, Feb 14, 2020 at 10:45:38AM -0500, Sasha Levin wrote:
> From: Simon Schwartz <kern.simon@...schwartz.xyz>
> 
> [ Upstream commit 39cc539f90d035a293240c9443af50be55ee81b8 ]
> 
> num_resources in the platform_device struct is declared as a u32.  The
> for loops that iterate over num_resources use an int as the counter,
> which can cause infinite loops on architectures with smaller ints.
> Change the loop counters to u32.
> 
> Signed-off-by: Simon Schwartz <kern.simon@...schwartz.xyz>
> Link: https://lore.kernel.org/r/2201ce63a2a171ffd2ed14e867875316efcf71db.camel@theschwartz.xyz
> Signed-off-by: Greg Kroah-Hartman <gregkh@...uxfoundation.org>
> Signed-off-by: Sasha Levin <sashal@...nel.org>
> ---
>  drivers/base/platform.c | 10 ++++++----
>  1 file changed, 6 insertions(+), 4 deletions(-)
> 
> diff --git a/drivers/base/platform.c b/drivers/base/platform.c
> index cf6b6b722e5c9..864b53b3d5980 100644
> --- a/drivers/base/platform.c
> +++ b/drivers/base/platform.c
> @@ -27,6 +27,7 @@
>  #include <linux/limits.h>
>  #include <linux/property.h>
>  #include <linux/kmemleak.h>
> +#include <linux/types.h>
>  
>  #include "base.h"
>  #include "power/power.h"
> @@ -48,7 +49,7 @@ EXPORT_SYMBOL_GPL(platform_bus);
>  struct resource *platform_get_resource(struct platform_device *dev,
>  				       unsigned int type, unsigned int num)
>  {
> -	int i;
> +	u32 i;
>  
>  	for (i = 0; i < dev->num_resources; i++) {
>  		struct resource *r = &dev->resource[i];
> @@ -255,7 +256,7 @@ struct resource *platform_get_resource_byname(struct platform_device *dev,
>  					      unsigned int type,
>  					      const char *name)
>  {
> -	int i;
> +	u32 i;
>  
>  	for (i = 0; i < dev->num_resources; i++) {
>  		struct resource *r = &dev->resource[i];
> @@ -501,7 +502,8 @@ EXPORT_SYMBOL_GPL(platform_device_add_properties);
>   */
>  int platform_device_add(struct platform_device *pdev)
>  {
> -	int i, ret;
> +	u32 i;
> +	int ret;
>  
>  	if (!pdev)
>  		return -EINVAL;
> @@ -590,7 +592,7 @@ EXPORT_SYMBOL_GPL(platform_device_add);
>   */
>  void platform_device_del(struct platform_device *pdev)
>  {
> -	int i;
> +	u32 i;
>  
>  	if (!IS_ERR_OR_NULL(pdev)) {
>  		device_del(&pdev->dev);
> -- 
> 2.20.1
> 

This doesn't solve a real issue, so please drop from everywhere.

thanks,

greg k-h