Received: by 2002:a05:6358:1087:b0:cb:c9d3:cd90 with SMTP id j7csp3889845rwi; Sat, 22 Oct 2022 01:38:01 -0700 (PDT) X-Google-Smtp-Source: AMsMyM5gJSf6l83YVlez9xxN0XLYKYSqxxstaks8v8YiATYitMYCmXEEN4ILZoqHbZYy4Lfr52O+ X-Received: by 2002:a17:902:c405:b0:181:83e4:490e with SMTP id k5-20020a170902c40500b0018183e4490emr22829580plk.4.1666427881082; Sat, 22 Oct 2022 01:38:01 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1666427881; cv=none; d=google.com; s=arc-20160816; b=wGKbcd6ytm97VVUIeKDzzVsnnLUHTeeqq4NfHdBxni83VoP+jQlC3QBCSOVagXp9bN f4rIWn8RLAdQkZeYGaOvJ8/uYkuaAGoyFmAi2r35MiiQHi/PUGhOSVU3iaIbYS6QT45Y vyH2gLZCplaMx9dtGM0OI/J89DtgkIjbpUUoid7WXXxdfzpVdOwO+7fLVVbGKyjasZak YOzkwzBnrtROqPzlhkhG+JRSNlPjbsWPn98Caa3Ls+vX5R1nAR9YEsGoZvDpSiPSSk59 wWrYOEkJq780sUMXE3n/dCJV0qt6FW0tgNj9mvMELhfhgJv+ETSPGls9zBWgs8H2BY41 xCTw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:content-transfer-encoding:mime-version :user-agent:references:in-reply-to:message-id:date:subject:cc:to :from:dkim-signature; bh=hJv7IUM6kJVsPIVNE+HRCOwEHEJ86PcnO/llMYLz+4M=; b=0LS6ZjYs0RAP9xk7pjHEZfZwlhJWoXm36tPvBHWgTfCG1hh0nVW0OQ43FnVYo2Hlmi eP1JHU1zam1QkbS3KffyzC8Fk3w2Z8xUucd66kf/WIfay59Xvaz0DAFzQJ2HO/k5ukb7 2BoTe81b87IHAVazDkMC4nc9tnt/OrulkghV/FaH1Zrr0kI+5hgxX+y4oa4KyQj9Uhlc mHi043Md7wo5nHIOBL8rAhXlHkcIa3VVtpqwvU33tHsVgDKSJ9l29RmkNaM+KttLJ7JD l70qoEzsyw3ZfEiRE6YPTijSkwWdRe+8SJ2yt2kPiYBOz335OCnTJfNU3kcmVNBN3PAZ 3lhA== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@linuxfoundation.org header.s=korg header.b=qDDvXkD3; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linuxfoundation.org Return-Path: Received: from out1.vger.email (out1.vger.email. [2620:137:e000::1:20]) by mx.google.com with ESMTP id 189-20020a6306c6000000b0046ec3ee4fafsi3993221pgg.211.2022.10.22.01.37.43; Sat, 22 Oct 2022 01:38:01 -0700 (PDT) Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20; Authentication-Results: mx.google.com; dkim=pass header.i=@linuxfoundation.org header.s=korg header.b=qDDvXkD3; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linuxfoundation.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S233727AbiJVIWx (ORCPT + 99 others); Sat, 22 Oct 2022 04:22:53 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:51514 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S233722AbiJVIU5 (ORCPT ); Sat, 22 Oct 2022 04:20:57 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 91C742DF477; Sat, 22 Oct 2022 00:58:51 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 33CCA60B09; Sat, 22 Oct 2022 07:58:51 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 09389C433D6; Sat, 22 Oct 2022 07:58:49 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1666425530; bh=R5xFzSHogEP2NN2e/wL2tnIj+3tgTrpSBrWmiZXApdA=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=qDDvXkD3EYzjQnMXli79oI7yzOSToyeiAF9jYXsdsfwMdtFDTqkLDrxw5NoLGRqyg Yd6QLOTfcs0j1mA5hxiYhoyl04NqtP9GoALw9IH17dTN+apZvihFeGIASm8l8pHlzy iPOwiGxoI6/6Xj4ZBSnCbYJwAyY6Ss+HwVRwLuac= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Dan Carpenter , Herbert Xu , Sasha Levin Subject: [PATCH 5.19 532/717] crypto: cavium - prevent integer overflow loading firmware Date: Sat, 22 Oct 2022 09:26:51 +0200 Message-Id: <20221022072521.848741405@linuxfoundation.org> X-Mailer: git-send-email 2.38.1 In-Reply-To: <20221022072415.034382448@linuxfoundation.org> References: <20221022072415.034382448@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit X-Spam-Status: No, score=-7.3 required=5.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,RCVD_IN_DNSWL_HI, SPF_HELO_NONE,SPF_PASS autolearn=ham autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on lindbergh.monkeyblade.net Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: Dan Carpenter [ Upstream commit 2526d6bf27d15054bb0778b2f7bc6625fd934905 ] The "code_length" value comes from the firmware file. If your firmware is untrusted realistically there is probably very little you can do to protect yourself. Still we try to limit the damage as much as possible. Also Smatch marks any data read from the filesystem as untrusted and prints warnings if it not capped correctly. The "ntohl(ucode->code_length) * 2" multiplication can have an integer overflow. Fixes: 9e2c7d99941d ("crypto: cavium - Add Support for Octeon-tx CPT Engine") Signed-off-by: Dan Carpenter Signed-off-by: Herbert Xu Signed-off-by: Sasha Levin --- drivers/crypto/cavium/cpt/cptpf_main.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/drivers/crypto/cavium/cpt/cptpf_main.c b/drivers/crypto/cavium/cpt/cptpf_main.c index 8c32d0eb8fcf..6872ac344001 100644 --- a/drivers/crypto/cavium/cpt/cptpf_main.c +++ b/drivers/crypto/cavium/cpt/cptpf_main.c @@ -253,6 +253,7 @@ static int cpt_ucode_load_fw(struct cpt_device *cpt, const u8 *fw, bool is_ae) const struct firmware *fw_entry; struct device *dev = &cpt->pdev->dev; struct ucode_header *ucode; + unsigned int code_length; struct microcode *mcode; int j, ret = 0; @@ -263,11 +264,12 @@ static int cpt_ucode_load_fw(struct cpt_device *cpt, const u8 *fw, bool is_ae) ucode = (struct ucode_header *)fw_entry->data; mcode = &cpt->mcode[cpt->next_mc_idx]; memcpy(mcode->version, (u8 *)fw_entry->data, CPT_UCODE_VERSION_SZ); - mcode->code_size = ntohl(ucode->code_length) * 2; - if (!mcode->code_size) { + code_length = ntohl(ucode->code_length); + if (code_length == 0 || code_length >= INT_MAX / 2) { ret = -EINVAL; goto fw_release; } + mcode->code_size = code_length * 2; mcode->is_ae = is_ae; mcode->core_mask = 0ULL; -- 2.35.1