diff options
| author | Giovanni Cabiddu <giovanni.cabiddu@intel.com> | 2024-10-21 13:37:53 +0100 |
|---|---|---|
| committer | Alex Williamson <alex.williamson@redhat.com> | 2024-10-30 13:38:38 -0600 |
| commit | 9283b7392570421c22a6c8058614f5b76a46b81c (patch) | |
| tree | 75d64d490c3784cc0e97a5880f440725cfda7c18 | |
| parent | 12cd88a9116acf79416a39adcd8bb1337ae7cee1 (diff) | |
| download | linux-9283b7392570421c22a6c8058614f5b76a46b81c.tar.gz linux-9283b7392570421c22a6c8058614f5b76a46b81c.tar.bz2 linux-9283b7392570421c22a6c8058614f5b76a46b81c.zip | |
vfio/qat: fix overflow check in qat_vf_resume_write()
The unsigned variable `size_t len` is cast to the signed type `loff_t`
when passed to the function check_add_overflow(). This function considers
the type of the destination, which is of type loff_t (signed),
potentially leading to an overflow. This issue is similar to the one
described in the link below.
Remove the cast.
Note that even if check_add_overflow() is bypassed, by setting `len` to
a value that is greater than LONG_MAX (which is considered as a negative
value after the cast), the function copy_from_user(), invoked a few lines
later, will not perform any copy and return `len` as (len > INT_MAX)
causing qat_vf_resume_write() to fail with -EFAULT.
Fixes: bb208810b1ab ("vfio/qat: Add vfio_pci driver for Intel QAT SR-IOV VF devices")
CC: stable@vger.kernel.org # 6.10+
Link: https://lore.kernel.org/all/138bd2e2-ede8-4bcc-aa7b-f3d9de167a37@moroto.mountain
Reported-by: Zijie Zhao <zzjas98@gmail.com>
Signed-off-by: Giovanni Cabiddu <giovanni.cabiddu@intel.com>
Reviewed-by: Xin Zeng <xin.zeng@intel.com>
Link: https://lore.kernel.org/r/20241021123843.42979-1-giovanni.cabiddu@intel.com
Signed-off-by: Alex Williamson <alex.williamson@redhat.com>
| -rw-r--r-- | drivers/vfio/pci/qat/main.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/drivers/vfio/pci/qat/main.c b/drivers/vfio/pci/qat/main.c index be3644ced17b..c78cb6de9390 100644 --- a/drivers/vfio/pci/qat/main.c +++ b/drivers/vfio/pci/qat/main.c @@ -304,7 +304,7 @@ static ssize_t qat_vf_resume_write(struct file *filp, const char __user *buf, offs = &filp->f_pos; if (*offs < 0 || - check_add_overflow((loff_t)len, *offs, &end)) + check_add_overflow(len, *offs, &end)) return -EOVERFLOW; if (end > mig_dev->state_size) |