linux-kernel - [PATCH] staging: vme_user: Validate geoid used for VME window address

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <20240621104246.11292-1-amishin@t-argos.ru>
Date: Fri, 21 Jun 2024 13:42:46 +0300
From: Aleksandr Mishin <amishin@...rgos.ru>
To: Martyn Welch <martyn.welch@...anuc.com>
CC: Aleksandr Mishin <amishin@...rgos.ru>, Greg Kroah-Hartman
	<gregkh@...uxfoundation.org>, Soumya Negi <soumya.negi97@...il.com>, Michael
 Straube <straube.linux@...il.com>, <linux-kernel@...r.kernel.org>,
	<linux-staging@...ts.linux.dev>, <lvc-project@...uxtesting.org>
Subject: [PATCH] staging: vme_user: Validate geoid used for VME window address

In tsi148_crcsr_init() value of vme_base used as 3rd parameter in
tsi148_master_set() call is calculated as 'vstat * 0x80000'. vstat value
can be set from module parameter "geoid" which can be any. In this case
the value of an arithmetic expression 'vstat * 0x80000' is a subject to
overflow because its operands are not cast to a larger data type before
performing arithmetic.

Add geoid validation to prevent overflow.

Found by Linux Verification Center (linuxtesting.org) with SVACE.

Fixes: d22b8ed9a3b0 ("Staging: vme: add Tundra TSI148 VME-PCI Bridge driver")
Signed-off-by: Aleksandr Mishin <amishin@...rgos.ru>
---
 drivers/staging/vme_user/vme_tsi148.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/staging/vme_user/vme_tsi148.c b/drivers/staging/vme_user/vme_tsi148.c
index 2ec9c2904404..b601d2b20bed 100644
--- a/drivers/staging/vme_user/vme_tsi148.c
+++ b/drivers/staging/vme_user/vme_tsi148.c
@@ -2119,7 +2119,7 @@ static int tsi148_slot_get(struct vme_bridge *tsi148_bridge)
 		slot = ioread32be(bridge->base + TSI148_LCSR_VSTAT);
 		slot = slot & TSI148_LCSR_VSTAT_GA_M;
 	} else {
-		slot = geoid;
+		slot = geoid & TSI148_LCSR_VSTAT_GA_M;
 	}
 
 	return (int)slot;
-- 
2.30.2