linux-kernel - Re: [PATCH 10/26] bus: mhi: host: use array

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <3b4ff79b-93b4-cf56-1488-113905b3981d@quicinc.com>
Date:   Fri, 23 Jun 2023 15:30:36 -0600
From:   Jeffrey Hugo <quic_jhugo@...cinc.com>
To:     Julia Lawall <Julia.Lawall@...ia.fr>,
        Manivannan Sadhasivam <mani@...nel.org>
CC:     <keescook@...omium.org>, <kernel-janitors@...r.kernel.org>,
        <mhi@...ts.linux.dev>, <linux-arm-msm@...r.kernel.org>,
        <linux-kernel@...r.kernel.org>
Subject: Re: [PATCH 10/26] bus: mhi: host: use array_size

On 6/23/2023 3:14 PM, Julia Lawall wrote:
> Use array_size to protect against multiplication overflows.
> 
> The changes were done using the following Coccinelle semantic patch:
> 
> // <smpl>
> @@
>      expression E1, E2;
>      constant C1, C2;
>      identifier alloc = {vmalloc,vzalloc};
> @@
>      
> (
>        alloc(C1 * C2,...)
> |
>        alloc(
> -           (E1) * (E2)
> +           array_size(E1, E2)
>        ,...)
> )
> // </smpl>
> 
> Signed-off-by: Julia Lawall <Julia.Lawall@...ia.fr>
> 
> ---
>   drivers/bus/mhi/host/init.c |    4 ++--
>   1 file changed, 2 insertions(+), 2 deletions(-)
> 
> diff --git a/drivers/bus/mhi/host/init.c b/drivers/bus/mhi/host/init.c
> index f72fcb66f408..34a543a67068 100644
> --- a/drivers/bus/mhi/host/init.c
> +++ b/drivers/bus/mhi/host/init.c
> @@ -759,8 +759,8 @@ static int parse_ch_cfg(struct mhi_controller *mhi_cntrl,
>   	 * so to avoid any memory possible allocation failures, vzalloc is
>   	 * used here
>   	 */
> -	mhi_cntrl->mhi_chan = vzalloc(mhi_cntrl->max_chan *
> -				      sizeof(*mhi_cntrl->mhi_chan));
> +	mhi_cntrl->mhi_chan = vzalloc(array_size(mhi_cntrl->max_chan,
> +				      sizeof(*mhi_cntrl->mhi_chan)));
>   	if (!mhi_cntrl->mhi_chan)
>   		return -ENOMEM;
>   
> 
> 

This doesn't seem like a good fix.

If we've overflowed the multiplication, I don't think we should 
continue, and the function should return an error.  array_size() is 
going to return SIZE_MAX, and it looks like it is possible that 
vzalloc() may be able to allocate that successfully in some scenarios. 
However, that is going to be less memory than parse_ch_cfg() expected to 
allocate, so later on I expect the function will still corrupt memory - 
basically the same result as what the unchecked overflow would do.

I'm not convinced the semantic patch is bringing value as I suspect most 
of the code being patched is in the same situation.

-Jeff