Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1751537AbdIAIYo (ORCPT ); Fri, 1 Sep 2017 04:24:44 -0400 Received: from userp1040.oracle.com ([156.151.31.81]:25323 "EHLO userp1040.oracle.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751434AbdIAIYm (ORCPT ); Fri, 1 Sep 2017 04:24:42 -0400 Date: Fri, 1 Sep 2017 11:24:16 +0300 From: Dan Carpenter To: Dison River Cc: sathya.prakash@broadcom.com, chaitra.basappa@broadcom.com, suganath-prabu.subramani@broadcom.com, MPT-FusionLinux.pdl@broadcom.com, linux-scsi@vger.kernel.org, linux-kernel@vger.kernel.org, security@kernel.org Subject: Re: Buffer overflow in the mptctl_replace_fw() function in linux kernel MPT ioctl driver Message-ID: <20170901082416.2mdhdpp46ismg2kp@mwanda> References: MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: User-Agent: NeoMutt/20170113 (1.7.2) X-Source-IP: aserv0022.oracle.com [141.146.126.234] Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 697 Lines: 18 On Fri, Sep 01, 2017 at 02:00:48PM +0800, Dison River wrote: > newFwSize = ALIGN(karg.newImageSize, 4); This is an integer overflow, but it's harmless... As a static checker developer this is where I would print a warning: drivers/message/fusion/mptctl.c:1748 mptctl_replace_fw() warn: potential integer overflow from user '((karg.newImageSize)) + (((4)) - 1)' I also caught the integer overflow from two days ago but there are too many ones like this so I can't check them all. In mpt_alloc_fw_memory() there is another potential integer overflow when we do: ioc->alloc_total += size; But ->alloc_total is not used anywhere. I don't see a buffer overflow here. regards, dan carpenter