Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
Date:   Thu, 7 Jul 2022 17:53:53 +0300
From:   Dan Carpenter <dan.carpenter@oracle.com>
To:     Jason Gunthorpe <jgg@ziepe.ca>
Cc:     Yishai Hadas <yishaih@nvidia.com>,
        Shameer Kolothum <shameerali.kolothum.thodi@huawei.com>,
        Kevin Tian <kevin.tian@intel.com>,
        Alex Williamson <alex.williamson@redhat.com>,
        Cornelia Huck <cohuck@redhat.com>,
        Leon Romanovsky <leon@kernel.org>, kvm@vger.kernel.org,
        linux-kernel@vger.kernel.org, kernel-janitors@vger.kernel.org
Subject: [PATCH] vfio/mlx5: clean up overflow check
Message-ID: <YsbzgQQ4bg6v+iTS@kili>
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
MIME-Version: 1.0
X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1
X-MS-Exchange-AntiSpam-MessageData-0: =?us-ascii?Q?2gGS1W3hxAFzEGFHnDDyScZ0ZjHTtTf7A2jAuLQh/OCyPoowu1nbmsXzf00R?=
 =?us-ascii?Q?evP9wWg6Mcq62/1QGett4FeowVnfENl5jELtNmHwrEXr8i58Ne3Y7jmmOGVt?=
 =?us-ascii?Q?qNdN2WpyOn3jonKjTaEoQWthD0hsKXifUISuhzXJSqMdK9W3k62WONaG3ePF?=
 =?us-ascii?Q?4gmdm2V55mw2WhkrLEy86TVMMmoOo8dgZS84UQxi82VIIOALsL+J0+V2+Nc5?=
 =?us-ascii?Q?JFQ5n9OvdZByErorx5bRE2+hjkA48B0oGd0wnkSBwtXgurxBGEQN3D9I3B1Z?=
 =?us-ascii?Q?ndmoKFAimL5pdT6qqI5Q9zgtELfg5agkqfJyTeQmYsCUPeS4XYxv1eLSsYtp?=
 =?us-ascii?Q?V03XPaMOqvkzlQk744Fypb8O1/kTvD89anW4BNq0GLcvtDW4qKB9QHgmBFwl?=
 =?us-ascii?Q?mqPZsB1YXRaUVmN3EH+Thate4fEUzsg8MN6wH9nSqIim4leunfRIzCs/OMma?=
 =?us-ascii?Q?X7rXXq+8M39O4GTqBPSufzvd9kwwUgzqmZ5YBwYKBh5pc05ctFcL0fhUSFnC?=
 =?us-ascii?Q?T8iJETShOJnE5w8jzL6DJmsYcBNGd6n383kB+nPm/80Wnm8AZoesFJhtSZG7?=
 =?us-ascii?Q?7VwSiCxptEzVApEY8nnEfSScseW/5jkvyBY1JKM5rGs+DkkwWRKN7MkQXyvO?=
 =?us-ascii?Q?XEoicshljpyHHvrDZJWN8Xu5Tc+fa5YalyR9fjtx7pnL2Kp2gP7XEl0yvUta?=
 =?us-ascii?Q?/yrP1fJQg9x8L5UPXJ7fEAUARkEvkj0xVlHyHNmHuxdWDXrpe51+tPAzehli?=
 =?us-ascii?Q?N6LO3tNkd6w0skGy0ZC9bB+XrWlGKXfFYR1rJRRLmkLcMrzXxNBMReBz4i/3?=
 =?us-ascii?Q?z5oT7uBUlwvCZt0CerOwcBu7Gs7roEr4Ji5ZS3rIr0rAO5RBK8n9oZ2yLD48?=
 =?us-ascii?Q?aVGqFLg8bgcI4662jyUg0vvf+y7m1UvF5DtdQ2O9wPtygKIQyhc1asZYwSYa?=
 =?us-ascii?Q?d2vpk5erCN6F3d8m47OuEw0gAgqM+SdfHfvxVo0JwgAYvmXvTvMyD2tScFy6?=
 =?us-ascii?Q?3gaFeeMhQLrPgqi2d9Gp5AiPbLS62VQiVGWMsj/mM3G4VHkwYmLmpCuAHVsy?=
 =?us-ascii?Q?b9wA70T3cTeNZ010HyrmfAyetTxDj5t6w9Kgi6PE9BHtnT6gX6Dz1KNtDMMX?=
 =?us-ascii?Q?K1NTKzZ220bsPkUH7TQPIaWezfK0HcC+vZ4dqcAyeHuM5iUIscYTswmKf4Og?=
 =?us-ascii?Q?+AZua5JqJ3sv0vLfqUg07Mh+4pAINuJ0pu6ooWR8P6vo5xDW1D1voY05XShV?=
 =?us-ascii?Q?SvvsZA9JmjXj+np4RPzRxxb6EaQl+AtRxUQFPETsUG/r4zxcGX9K2Yzw2+ui?=
 =?us-ascii?Q?JNVwckJPOkwEUVWfbutyHen9EI0mWDw73ISAsxtNwJBQurNRZNiIptifMx5O?=
 =?us-ascii?Q?fyHNTzYrvEbzcWsfFyholanGvQUCqaAve3z3SgZTkpTKkKH5EGSdXyxRR3qo?=
 =?us-ascii?Q?AA4ASmIMTH2MqMSPFi1zXQuwaiwuVTNjshHR9P0dm5znVq5IOKnVZ9+oUfPx?=
 =?us-ascii?Q?Mpi3XwRC0BuN1iY9DeAvm2DCPsrLGWhNNZ8sy5n7w2hUJltHC73Ykvq9Mu1f?=
 =?us-ascii?Q?QB31X75FTw6+vK7yOdndj1KHOt2QKQmkuqj3R2Hr?=
X-OriginatorOrg: oracle.com
X-MS-Exchange-CrossTenant-Network-Message-Id: 364df5ef-8172-4588-1cfd-08da602889f5
X-MS-Exchange-CrossTenant-AuthSource: MWHPR1001MB2365.namprd10.prod.outlook.com
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 07 Jul 2022 14:54:05.7253
 (UTC)
X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted
X-MS-Exchange-CrossTenant-Id: 4e2c6054-71cb-48f1-bd6c-3a9705aca71b
X-MS-Exchange-CrossTenant-MailboxType: HOSTED
X-MS-Exchange-CrossTenant-UserPrincipalName: +at03cn+q4+xn67SHCLuTmeBkjvCtz/gj1xX8HfKQbNCxs19G9R6DFbMUtbTcbtz9hAidQUmUauv/yXNfE9uLZOWa7stBujpiI974y1Ugpw=
X-MS-Exchange-Transport-CrossTenantHeadersStamped: IA1PR10MB6100
X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10434:6.0.517,18.0.883
 definitions=2022-07-07_12:2022-06-28,2022-07-07 signatures=0
X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 bulkscore=0 suspectscore=0 phishscore=0
 mlxlogscore=999 spamscore=0 adultscore=0 malwarescore=0 mlxscore=0
 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2206140000
 definitions=main-2207070058
X-Proofpoint-ORIG-GUID: xArhoxJuktsP3FBJH_FBs4KfJ7YJMxhQ
X-Proofpoint-GUID: xArhoxJuktsP3FBJH_FBs4KfJ7YJMxhQ
X-Spam-Status: No, score=-2.8 required=5.0 tests=BAYES_00,DKIM_SIGNED,
        DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,RCVD_IN_DNSWL_LOW,
        RCVD_IN_MSPIKE_H2,SPF_HELO_NONE,SPF_NONE,T_SCC_BODY_TEXT_LINE
        autolearn=ham autolearn_force=no version=3.4.6
X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on
        lindbergh.monkeyblade.net
Precedence: bulk
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: linux-kernel@vger.kernel.org

The casting on this overflow check is not done correctly, but
fortunately checks in the callers should prevent this from affecting
runtime.

The "len" variable is unsigned long while "*pos" and "requested_length"
are signed long long.  Imagine "len" was ULONG_MAX and "*pos" was 2.
Then "ULONG_MAX + 2 = 1" which is an integer overflow so it will be
caught.  However if we cast "len" to a long long then it becomes
"-1 + 2 = 1" which is not an integer overflow and will not be caught.

However "len" cannot actually be that high and the check for "*pos < 0"
means that this cannot happen.  Still it's worth cleaning up just as a
hardenning measure and so that it's not copy and pasted to other places.

Fixes: 6fadb021266d ("vfio/mlx5: Implement vfio_pci driver for mlx5 devices")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
---
 drivers/vfio/pci/mlx5/main.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/drivers/vfio/pci/mlx5/main.c b/drivers/vfio/pci/mlx5/main.c
index a9b63d15c5d3..c65dca59caec 100644
--- a/drivers/vfio/pci/mlx5/main.c
+++ b/drivers/vfio/pci/mlx5/main.c
@@ -271,15 +271,15 @@ static ssize_t mlx5vf_resume_write(struct file *filp, const char __user *buf,
 				   size_t len, loff_t *pos)
 {
 	struct mlx5_vf_migration_file *migf = filp->private_data;
-	loff_t requested_length;
+	unsigned long requested_length;
 	ssize_t done = 0;
 
 	if (pos)
 		return -ESPIPE;
 	pos = &filp->f_pos;
 
-	if (*pos < 0 ||
-	    check_add_overflow((loff_t)len, *pos, &requested_length))
+	if (*pos < 0 || *pos > ULONG_MAX ||
+	    check_add_overflow(len, (unsigned long)*pos, &requested_length))
 		return -EINVAL;
 
 	if (requested_length > MAX_MIGRATION_SIZE)
-- 
2.35.1