Message-ID: <777498f0-9a0f-6ff7-ecc6-9fc53e8c558d@intel.com>
Date:   Mon, 6 Feb 2023 08:50:31 -0800
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:102.0) Gecko/20100101
 Firefox/102.0 Thunderbird/102.4.2
Subject: Re: [PATCH] fpga: dfl-afu-region: Add overflow checks for region size
 and offset
Content-Language: en-US
To:     <k1rh4.lee@gmail.com>, Wu Hao <hao.wu@intel.com>
CC:     Tom Rix <trix@redhat.com>, Moritz Fischer <mdf@kernel.org>,
        Xu Yilun <yilun.xu@intel.com>, <linux-fpga@vger.kernel.org>,
        <linux-kernel@vger.kernel.org>
References: <20230206054326.89323-1-k1rh4.lee@gmail.com>
From:   Russ Weight <russell.h.weight@intel.com>
In-Reply-To: <20230206054326.89323-1-k1rh4.lee@gmail.com>
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: 7bit
MIME-Version: 1.0
X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1
X-MS-Exchange-AntiSpam-MessageData-0: =?utf-8?B?enROekV3eXpZdmZNYVBhbzZzdWcxTVBrbXdkNHNIRjVqelRYSDV1aWlrSlY3?=
 =?utf-8?B?Q2NlV3lTa056LzVCRlFadlc0cnF4TUlvOFd5Rnp3ZmhxOGtYQ2FvdU5rbnJv?=
 =?utf-8?B?cnd0V0hRNFBqQmhzSW5McWhXNTZ1VHNhU3JGVDJMdVBCMC8zcjY3R1NxMlNn?=
 =?utf-8?B?UWhIVVJEN3Y5VjNWRnQ3ZkxSMGY5cG9HRnhrSk45QUxWV21oSll3RWxTa21m?=
 =?utf-8?B?S055NDIwZGpNRTZWN3ZzNER4cGN6VUwzekVvTE0yNTNYWkZxTFZRV0ZlU21R?=
 =?utf-8?B?aGhVR3ZFU3BXT1ZtWnpXQ0EyTVhZT1lWYitMcnhUUWN3dExaNjJJS3JEWjhH?=
 =?utf-8?B?MFhpQlhYQy9FV1lrTzBKWEVBNDJHSDdwUFVDaitjeFV3ZWRDQ0pic3F1WGdw?=
 =?utf-8?B?V1B5ZDVnbiswQStYMFhOUk01SVg4cWdGNUQ5TEk4NXQydVlSNFEzSjFXejAx?=
 =?utf-8?B?dlU1N1V6dlU4M3VmMEs5MmRoaEM3bVdUOXJyMUtPMjEyYm9BMlhtUkRmdWYy?=
 =?utf-8?B?dUxuVWFNeGJMb1k0Tzk1MmE0cldiVmRJaktpTDU4NmgxZU9zOEtCeEt2TmZH?=
 =?utf-8?B?dmtqOHBwbmdSaCtPeS9aTllwRUEyREdVSklnN1dmcmRoTU9Cb2ovV21zaG8y?=
 =?utf-8?B?UFZWK1M2Sm5Ca05xVTd6ZFVieW9nek1mdVIyeFVQV1VjeThtN3pZU2tIZUFI?=
 =?utf-8?B?R0VmVkFBRGFTQm8vUTRkYXBWWjNUM0dlZ2NSa3FFaGdTcGkzUnU0ejVjYW1N?=
 =?utf-8?B?VjBKNmlrVWZscWc0YUZ6VktyQUZYL24zYlF4T3VDWGJyN0R1Mk1zN1U3eXdG?=
 =?utf-8?B?aGF3YmdyR0xQK0hmL05COEkwbUlhUC8vekkyYVVocnpvbWJxQkpmM1hXSnZo?=
 =?utf-8?B?QklyRFB4YnloZnRPUytJSHJFeDdPajJWczNIeDkxSm84Ym83ZWRwUi8yblgr?=
 =?utf-8?B?dGRQdlBvdmpSdWRFdDQyd25nb0trNG8yUjd5UlhhNlZjNWZMWHNlNFVZVSti?=
 =?utf-8?B?cTZOOWJZelpKN3I0cG1DZzhxVmYvaHFRNGNNK2wrSFNKaGxWbWRRcTFpcGFI?=
 =?utf-8?B?dnp2ZCtOZVRvWWpnem4xRjcxWng4T3BhYjZZbWpkTlZzcVdSQlRxc1FwUXA4?=
 =?utf-8?B?dVplTXBKZXlRK0FhMjlyVFk2cGRtUWVSdDB4b2RuOHpVUmtSSzA5S0lRODFk?=
 =?utf-8?B?MHRNK1V5MlRtcjh1ZTFPalFjeFdoKzdhMVRCbGhrdnhnaUtCZS9jcEh2L0lr?=
 =?utf-8?B?OC8wZXl1SWo5anl2RHpUaFpzTlJRc2lvNGFrQzJEUFcvSzdjR2FVUWFKMEpO?=
 =?utf-8?B?YlFZZlhscFRLbEtocFU3NTFESlpnTm0wYkNaaHlPNXF1MGszSVlQZlVnUjVB?=
 =?utf-8?B?RnZFaUNHazM4YVpTbjJWSzlkUkV2QVg3NVp6WS83QWs1L0V6KzNXM2puT2dm?=
 =?utf-8?B?VGhxS2EraVdEcklKWFAwNlJnR29ZN2tCc21lRjRPMTE0RnZEVTZqRkZ6bnhV?=
 =?utf-8?B?Mmh1d2ZnSWxaVVVuRW1BY09qNCtiUEtPSVgzUURWbVFyY2NuMXc2dUdJd3Zw?=
 =?utf-8?B?b3Jmd3BhVHRXeVczNjcvMjhnVTQvL0JKaW45VXUwamlpRWlhekxTQXRWRmVo?=
 =?utf-8?B?UXVXQ3JsdlplSTczWTJTaWFjd0RTWjI5RVJuZmh4SlZHNzdNMWxwd3BDcWdv?=
 =?utf-8?B?Ri9OSXo0OHRjbzAzQVM0NmdCcHBkMnQ0ZWlZNGg1Nzl2aUJjb01HMElsaUpJ?=
 =?utf-8?B?MUwzQ3ZjUlhHUU9BMzdmTi9BbGRTMXdGcVY4UldVd0tmOW1veFMzY2FXdEoy?=
 =?utf-8?B?NTB1NitNK3UxUk9UVGROaW5PZXBQWW9kWURxS3ZoUzc5VVdlOEhoL2o2Y1d0?=
 =?utf-8?B?NGg5YUM3ZytaaHdCQm80OTVMaGVmVkFRcmpjSWZ1TXhXdEd2MDBVYWYzbEJO?=
 =?utf-8?B?MUQ2YnprRTRDZ2Fsckg3OTJEWWFoZVlYWCtzWlJBc1NoVEp0ekpaQXJWNTl0?=
 =?utf-8?B?czI5M1FCZ01RMThiZHlCNXlRZDZqcnVURjN2UnNMS2hHczhUNHBEeSt1SmJT?=
 =?utf-8?B?QitWUThKeUxqaE5RT3BpcnBWbWxoYTk2RXNGMG8xWEo0eDB2ckRpbUVNNHY1?=
 =?utf-8?B?MGUxRlBnb0lIeXIwekk0T2kzM0hqTU5WRVlhdVJPTGlaM2E5VSsyUnhKSjJ1?=
 =?utf-8?B?dFE9PQ==?=
X-MS-Exchange-CrossTenant-Network-Message-Id: 311fe19e-39c4-4152-aa3f-08db08624518
X-MS-Exchange-CrossTenant-AuthSource: DM5PR11MB1899.namprd11.prod.outlook.com
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 06 Feb 2023 16:50:36.5243
 (UTC)
X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted
X-MS-Exchange-CrossTenant-Id: 46c98d88-e344-4ed4-8496-4ed7712e255d
X-MS-Exchange-CrossTenant-MailboxType: HOSTED
X-MS-Exchange-CrossTenant-UserPrincipalName: qHgGqbtwxXRF1I3jhoNP/9yFikKAewiTHXiovADnl4bF7J1Ns+pL8uYEH9lxQDVA+1Ixwvezeo5m6LCeBpTj6Pv6vNsUf32VW9eg+q13sjI=
X-MS-Exchange-Transport-CrossTenantHeadersStamped: CH0PR11MB5491
X-OriginatorOrg: intel.com
Precedence: bulk
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: linux-kernel@vger.kernel.org


On 2/5/23 21:43, k1rh4.lee@gmail.com wrote:
> From: Sangsup Lee <k1rh4.lee@gmail.com>
>
> The size + offset is able to be integer overflow value and it lead to mis-allocate region.
Reviewed-by: Russ Weight <russell.h.weight@intel.com>
> Signed-off-by: Sangsup Lee <k1rh4.lee@gmail.com>
> ---
>  drivers/fpga/dfl-afu-region.c | 7 ++++++-
>  1 file changed, 6 insertions(+), 1 deletion(-)
>
> diff --git a/drivers/fpga/dfl-afu-region.c b/drivers/fpga/dfl-afu-region.c
> index 2e7b41629406..82b530111601 100644
> --- a/drivers/fpga/dfl-afu-region.c
> +++ b/drivers/fpga/dfl-afu-region.c
> @@ -151,12 +151,17 @@ int afu_mmio_region_get_by_offset(struct dfl_feature_platform_data *pdata,
>  	struct dfl_afu_mmio_region *region;
>  	struct dfl_afu *afu;
>  	int ret = 0;
> +	u64 region_size = 0;
>  
>  	mutex_lock(&pdata->lock);
> +	if (check_add_overflow(offset, size, &region_size)) {
> +		ret = -EINVAL;
> +		goto exit;
> +	}
>  	afu = dfl_fpga_pdata_get_private(pdata);
>  	for_each_region(region, afu)
>  		if (region->offset <= offset &&
> -		    region->offset + region->size >= offset + size) {
> +		    region->offset + region->size >= region_size) {
>  			*pregion = *region;
>  			goto exit;
>  		}