Received: by 2002:ac0:a5b6:0:0:0:0:0 with SMTP id m51-v6csp2346450imm; Mon, 28 May 2018 06:28:26 -0700 (PDT) X-Google-Smtp-Source: AB8JxZqAi2xLuYnT4lsgSyf8BXsJNa5Ynxkj7N34Xs5IMcmVAa+GQumQMc+ktqmUvE4BOpMfljVB X-Received: by 2002:a63:af0e:: with SMTP id w14-v6mr10678598pge.221.1527514106884; Mon, 28 May 2018 06:28:26 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1527514106; cv=none; d=google.com; s=arc-20160816; b=ZhCzY/RxaZBzQ9zT1+QXrJMPp4g8mGpeTqI8ipkeRql0p0oGbGATUGSh8LUUEXG8kh P+QQhzHUbKhsehQNbqh1ZIvfLzyf/ZvSdvvO7HEgDeWBigd5YAC0JIJuGTzX/sm4W/aG YPTXTKLbO9ufilrEBJuyPfUKDuXwuffLSN35wgIq+4YyYqeE0JB836WudAtbw8p56p7p mqKEaR0QLc7ZJeqrrbVTkVW1mPaQRZPe15y/ewbrei7XpvBIrZQ57x9HwcIA396oO83F LvYtJGg9BYizoHCIEQ/hV3FaH7pGcF0FFhDJjSSM8vkwczofkovyUx04XQdhTGtzzqUd PI4A== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:sender:mime-version:user-agent:references :in-reply-to:message-id:date:subject:cc:to:from:dkim-signature :arc-authentication-results; bh=DQGzZjzgb3VvRNbretxjoswSduKJWUEAuyGuGuNOK+k=; b=jtVWRtDB/aqzQkeWprtVDieHA+MpjAOQWkupM6hx0Apc9a6PfcwcbaX0kGKKWy36Ky NsAZ5wlxPrs93RLFqIiAn+lv+XzURqvWjphhovSn78aB3nXbaB7kK/J3TAP/mt/+Vvk+ f7++3b9QjlYT+EMydgpXGei+eRuj3IGpcjAgupi7L3uZHpD7fDMx1LdjG8IYeCm5LwZs 1FnJO+x55Ot7YH3y9lvO+OXZD9ewZQ5sGIohx+79bwUpfiqLk7Jgt+0fUIjD2nud0BsG C0znUDAATks1R7SznHYAQNpatdtEIyhM6PfNfPtX3mnkM9K/iQLB45Gm+seHf+r62KcP jcqQ== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@kernel.org header.s=default header.b=NkmReA2B; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Return-Path: Received: from vger.kernel.org (vger.kernel.org. [209.132.180.67]) by mx.google.com with ESMTP id p25-v6si4651551pfi.345.2018.05.28.06.28.11; Mon, 28 May 2018 06:28:26 -0700 (PDT) Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67; Authentication-Results: mx.google.com; dkim=pass header.i=@kernel.org header.s=default header.b=NkmReA2B; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1163321AbeE1N1W (ORCPT + 99 others); Mon, 28 May 2018 09:27:22 -0400 Received: from mail.kernel.org ([198.145.29.99]:37662 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1163106AbeE1Krg (ORCPT ); Mon, 28 May 2018 06:47:36 -0400 Received: from localhost (LFbn-1-12247-202.w90-92.abo.wanadoo.fr [90.92.61.202]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id 3ED6E20660; Mon, 28 May 2018 10:47:35 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1527504455; bh=mRpReEns+xOLYgR34h6lNPI9IUX/Kwoj1YAEOVeqebM=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=NkmReA2BqZYCiKbqiMABZXCRvs/TrNhspaM7bIZJqHPamfgK//2KFkj/UwA5uward qaccVHuue7NevGC8j/anC0ta/LyNZ6Ii+z8/bA10iyLveSYXLqggswVe8s1RhjSBy9 OKyS9Kcq6tV8jeePrvV+U65/iiuxBqpIb3WX5H/Q= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, David Rientjes , Andrew Morton , Jens Axboe , Dave Jiang , Al Viro , Dan Carpenter , Linus Torvalds , Sasha Levin Subject: [PATCH 4.14 112/496] kernel/relay.c: limit kmalloc size to KMALLOC_MAX_SIZE Date: Mon, 28 May 2018 11:58:17 +0200 Message-Id: <20180528100324.632123087@linuxfoundation.org> X-Mailer: git-send-email 2.17.0 In-Reply-To: <20180528100319.498712256@linuxfoundation.org> References: <20180528100319.498712256@linuxfoundation.org> User-Agent: quilt/0.65 X-stable: review MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Sender: linux-kernel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org 4.14-stable review patch. If anyone has any objections, please let me know. ------------------ From: David Rientjes [ Upstream commit 88913bd8ea2a75d7e460a4bed5f75e1c32660d7e ] chan->n_subbufs is set by the user and relay_create_buf() does a kmalloc() of chan->n_subbufs * sizeof(size_t *). kmalloc_slab() will generate a warning when this fails if chan->subbufs * sizeof(size_t *) > KMALLOC_MAX_SIZE. Limit chan->n_subbufs to the maximum allowed kmalloc() size. Link: http://lkml.kernel.org/r/alpine.DEB.2.10.1802061216100.122576@chino.kir.corp.google.com Fixes: f6302f1bcd75 ("relay: prevent integer overflow in relay_open()") Signed-off-by: David Rientjes Reviewed-by: Andrew Morton Cc: Jens Axboe Cc: Dave Jiang Cc: Al Viro Cc: Dan Carpenter Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds Signed-off-by: Sasha Levin Signed-off-by: Greg Kroah-Hartman --- kernel/relay.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) --- a/kernel/relay.c +++ b/kernel/relay.c @@ -163,7 +163,7 @@ static struct rchan_buf *relay_create_bu { struct rchan_buf *buf; - if (chan->n_subbufs > UINT_MAX / sizeof(size_t *)) + if (chan->n_subbufs > KMALLOC_MAX_SIZE / sizeof(size_t *)) return NULL; buf = kzalloc(sizeof(struct rchan_buf), GFP_KERNEL);