lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
Open Source and information security mailing list archives
| ||
|
Date: Sat, 17 Dec 2022 10:27:18 -0500 From: Sasha Levin <sashal@...nel.org> To: linux-kernel@...r.kernel.org, stable@...r.kernel.org Cc: Zheng Yejian <zhengyejian1@...wei.com>, Hanjun Guo <guohanjun@...wei.com>, Randy Dunlap <rdunlap@...radead.org>, Vlastimil Babka <vbabka@...e.cz>, Zhang Jinhao <zhangjinhao2@...wei.com>, Andrew Morton <akpm@...ux-foundation.org>, Sasha Levin <sashal@...nel.org>, tangmeng@...ontech.com, willy@...radead.org Subject: [PATCH AUTOSEL 6.1 17/22] acct: fix potential integer overflow in encode_comp_t() From: Zheng Yejian <zhengyejian1@...wei.com> [ Upstream commit c5f31c655bcc01b6da53b836ac951c1556245305 ] The integer overflow is descripted with following codes: > 317 static comp_t encode_comp_t(u64 value) > 318 { > 319 int exp, rnd; ...... > 341 exp <<= MANTSIZE; > 342 exp += value; > 343 return exp; > 344 } Currently comp_t is defined as type of '__u16', but the variable 'exp' is type of 'int', so overflow would happen when variable 'exp' in line 343 is greater than 65535. Link: https://lkml.kernel.org/r/20210515140631.369106-3-zhengyejian1@huawei.com Signed-off-by: Zheng Yejian <zhengyejian1@...wei.com> Cc: Hanjun Guo <guohanjun@...wei.com> Cc: Randy Dunlap <rdunlap@...radead.org> Cc: Vlastimil Babka <vbabka@...e.cz> Cc: Zhang Jinhao <zhangjinhao2@...wei.com> Signed-off-by: Andrew Morton <akpm@...ux-foundation.org> Signed-off-by: Sasha Levin <sashal@...nel.org> --- kernel/acct.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/kernel/acct.c b/kernel/acct.c index 62200d799b9b..034a26daabb2 100644 --- a/kernel/acct.c +++ b/kernel/acct.c @@ -350,6 +350,8 @@ static comp_t encode_comp_t(unsigned long value) exp++; } + if (exp > (((comp_t) ~0U) >> MANTSIZE)) + return (comp_t) ~0U; /* * Clean it up and polish it off. */ -- 2.35.1
Powered by blists - more mailing lists