Received-SPF: pass (google.com: domain of linux-crypto-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
Date:   Thu, 1 Sep 2022 18:32:09 +0300
From:   Dan Carpenter <dan.carpenter@oracle.com>
To:     Boris Brezillon <bbrezillon@kernel.org>
Cc:     Arnaud Ebalard <arno@natisbad.org>,
        Srujana Challa <schalla@marvell.com>,
        Herbert Xu <herbert@gondor.apana.org.au>,
        "David S. Miller" <davem@davemloft.net>,
        Wolfram Sang <wsa+renesas@sang-engineering.com>,
        Giovanni Cabiddu <giovanni.cabiddu@intel.com>,
        Lukasz Bartosik <lbartosik@marvell.com>,
        linux-crypto@vger.kernel.org, kernel-janitors@vger.kernel.org
Subject: [PATCH] crypto: marvell/octeontx - prevent integer overflows
Message-ID: <YxDQeeqY6u5EBn5H@kili>
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
MIME-Version: 1.0
X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1
X-MS-Exchange-AntiSpam-MessageData-0: =?us-ascii?Q?MjGFRdvvRIaXCbVtwBrw6DDcwR6ADK7ansr8hoSH60ZyVrt2Rb3DAGwa1Xcz?=
 =?us-ascii?Q?X7Fxq93oflgH96jVIomE6To5EFO0lTvmTzzUV+0/+YTdq0iGiXhgXaGH7VaY?=
 =?us-ascii?Q?GVcsZbj2nlutNB101QJlid965cJ9uqSiGDniv9LYwj3zqn0RJAGlYsPL2+wd?=
 =?us-ascii?Q?Wg1NEqs7v0YFPaJ2R+poB7104rQyc5BCsmNrR+Ig6HmxvIKGv5D5BoyzgkOr?=
 =?us-ascii?Q?Ehs9Yv5sWXkQY5UI1ExTutiv8TOTs7r2vD/iXKBRSxZV++4L051i/7x0p8Uq?=
 =?us-ascii?Q?CG71x2GELHlAb70BQF1j9uFYhXyVR9a63CeH0dpCcBYvkhNcq+8GkNLbGvTe?=
 =?us-ascii?Q?2EpR2jpEZ8dsxmlqipbbfiQKrabUdx3JA5Zi5Hp1nadiKK+7ORkEqoO/x6rf?=
 =?us-ascii?Q?1l6USDmloTwVUejtbaxbl20SxDWADaxvCNd8w0+PnD8nWqaadvBksReLzbkK?=
 =?us-ascii?Q?qn0gaoZBot326X2mVnnzC3dV3o8FBRT/Zc2KxS0hjXfy98xlHjlkEe2wCej8?=
 =?us-ascii?Q?vXINcxbeG+xKjZcT9Qvvg8HAU5twv34YSdw/aHPWVw3ueudwu+4Goe0tR28D?=
 =?us-ascii?Q?6839/9sTdX9hqltFc6qo9NAW2QVZWWM7Vdc5STKSMa3d06OoTwHr3jPPzA/o?=
 =?us-ascii?Q?rfkPHyUjcjyhF+LQi0PGRsE1Ui/XsZJ8Fav7wOAiHvKVSd6Kb22rw40tEG9q?=
 =?us-ascii?Q?GT/bmuk9kOJUJ5DRQ7Ueji+stp7IEvEvwSD3xqL5rihgSP1XnP3OnN1W7I8E?=
 =?us-ascii?Q?QsBtA9W8FK9jFJVBjBsNZxrv+NTNIydLRRON73U5wtpUvtvJv3bB+2cZOx8O?=
 =?us-ascii?Q?qz9ZUHpx2SmIKILCSUdevmzKHQ+qbLC47/vISM0yQmDEkdmz2NXPJvLd3lkp?=
 =?us-ascii?Q?ItLGULJba9cUqZbEJYH8PZN02jov4sfI5Gc5coWvLOjkhegez69oPwCdsJBM?=
 =?us-ascii?Q?AefKMsmH5xVig9eMaxKjIGcDPzAC2Sogy/sk5ucvsxHUPOcHJ0UcrnYhvhca?=
 =?us-ascii?Q?MSLoadxNSBDEi0QgJFbHz4btlz5EYAZFI1bLg9XvxESdnOj1p3ccpK6WX9si?=
 =?us-ascii?Q?c9yRRX50B5nXqdtgeqAuRQKCcwTILNL6UG+q3ge8WstGLGpKOJzdUimItmwP?=
 =?us-ascii?Q?y2NxZH7zCpn7+WrHYWEK1NecGcd+ITr7ml2pxteiCz6fDgurjc9kJ0sMl1Yr?=
 =?us-ascii?Q?/D/ebW/xnOrKJHqCjsgkplGN8t/laHOpwIOlIBZskjqAahSbEdCPLbQSk/19?=
 =?us-ascii?Q?Z+kfR3kE1t0GTN2BAF/ehSYCwQ7ypjg9y3f0XqVy9fFTURVvzm23KCcV0Ej2?=
 =?us-ascii?Q?We+dETdGxDGYjX9G0VJSNvPqVQXZsb1K/Is8oedIkHXmi0lOq3wnNoMNG9Zr?=
 =?us-ascii?Q?RJtPJBY355zxpnq5VVg16QHdDrbYKcmoXxgqKje0nmfHNPJ6EmyWjt/PDncY?=
 =?us-ascii?Q?Zl98ilN+L029/g/CiUR4opIqjWRTaluVyUW6Aezi40ALGrqw+djEWQFty14d?=
 =?us-ascii?Q?r4RtdNUpX3KLfkjRfc/ZBxjbPaPrBvc470bW1ZoITZLGGjIx3o0nNoToLd1D?=
 =?us-ascii?Q?MQTytjAcQiVOiTZxFLfZUe2/qczkpQ0VBZWi8Kh0rF3FtDaqoEQ63VWgovjF?=
 =?us-ascii?Q?aQ=3D=3D?=
X-OriginatorOrg: oracle.com
X-MS-Exchange-CrossTenant-Network-Message-Id: 551864da-04f6-449b-73df-08da8c2f28fd
X-MS-Exchange-CrossTenant-AuthSource: MWHPR1001MB2365.namprd10.prod.outlook.com
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 01 Sep 2022 15:32:20.7271
 (UTC)
X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted
X-MS-Exchange-CrossTenant-Id: 4e2c6054-71cb-48f1-bd6c-3a9705aca71b
X-MS-Exchange-CrossTenant-MailboxType: HOSTED
X-MS-Exchange-CrossTenant-UserPrincipalName: Jwk1mg0UIez5ChqEmsBEa0oxpOSQ/tSad6hftcZIsSjdqaMsr4HBATcgsykTQ2ISbxb6ryaMCSW1zTSyB/dLvdoiIQQ+XDXETxTH4XbJCaM=
X-MS-Exchange-Transport-CrossTenantHeadersStamped: MN2PR10MB4205
X-Proofpoint-Virus-Version: vendor=baseguard
 engine=ICAP:2.0.205,Aquarius:18.0.895,Hydra:6.0.517,FMLib:17.11.122.1
 definitions=2022-09-01_10,2022-08-31_03,2022-06-22_01
X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 bulkscore=0 mlxlogscore=999
 phishscore=0 suspectscore=0 malwarescore=0 adultscore=0 spamscore=0
 mlxscore=0 classifier=spam adjust=0 reason=mlx scancount=1
 engine=8.12.0-2207270000 definitions=main-2209010070
X-Proofpoint-GUID: bDj3pmDFWmrAaKUdoStnhS3pgF8gzzOt
X-Proofpoint-ORIG-GUID: bDj3pmDFWmrAaKUdoStnhS3pgF8gzzOt
X-Spam-Status: No, score=-2.8 required=5.0 tests=BAYES_00,DKIM_SIGNED,
        DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,RCVD_IN_DNSWL_LOW,
        RCVD_IN_MSPIKE_H2,SPF_HELO_NONE,SPF_NONE,T_SCC_BODY_TEXT_LINE
        autolearn=ham autolearn_force=no version=3.4.6
X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on
        lindbergh.monkeyblade.net
Precedence: bulk
List-ID: <linux-crypto.vger.kernel.org>
X-Mailing-List: linux-crypto@vger.kernel.org

The "code_length * 2" can overflow.  The round_up(ucode_size, 16) +
sizeof() expression can overflow too.  Prevent these overflows.

Fixes: d9110b0b01ff ("crypto: marvell - add support for OCTEON TX CPT engine")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
---
I chose INT_MAX because it's way higher than what kmalloc() can allocate
and it makes the code simpler.  I think there is a static checker which
tells people to change these to UINT_MAX.  Don't do that, or at least
CC me if you do.

 .../crypto/marvell/octeontx/otx_cptpf_ucode.c | 23 +++++++++++++++----
 1 file changed, 19 insertions(+), 4 deletions(-)

diff --git a/drivers/crypto/marvell/octeontx/otx_cptpf_ucode.c b/drivers/crypto/marvell/octeontx/otx_cptpf_ucode.c
index 23c6edc70914..1be85820d677 100644
--- a/drivers/crypto/marvell/octeontx/otx_cptpf_ucode.c
+++ b/drivers/crypto/marvell/octeontx/otx_cptpf_ucode.c
@@ -286,6 +286,7 @@ static int process_tar_file(struct device *dev,
 	struct tar_ucode_info_t *tar_info;
 	struct otx_cpt_ucode_hdr *ucode_hdr;
 	int ucode_type, ucode_size;
+	unsigned int code_length;
 
 	/*
 	 * If size is less than microcode header size then don't report
@@ -303,7 +304,13 @@ static int process_tar_file(struct device *dev,
 	if (get_ucode_type(ucode_hdr, &ucode_type))
 		return 0;
 
-	ucode_size = ntohl(ucode_hdr->code_length) * 2;
+	code_length = ntohl(ucode_hdr->code_length);
+	if (code_length >= INT_MAX / 2) {
+		dev_err(dev, "Invalid code_length %u\n", code_length);
+		return -EINVAL;
+	}
+
+	ucode_size = code_length * 2;
 	if (!ucode_size || (size < round_up(ucode_size, 16) +
 	    sizeof(struct otx_cpt_ucode_hdr) + OTX_CPT_UCODE_SIGN_LEN)) {
 		dev_err(dev, "Ucode %s invalid size\n", filename);
@@ -886,6 +893,7 @@ static int ucode_load(struct device *dev, struct otx_cpt_ucode *ucode,
 {
 	struct otx_cpt_ucode_hdr *ucode_hdr;
 	const struct firmware *fw;
+	unsigned int code_length;
 	int ret;
 
 	set_ucode_filename(ucode, ucode_filename);
@@ -896,9 +904,16 @@ static int ucode_load(struct device *dev, struct otx_cpt_ucode *ucode,
 	ucode_hdr = (struct otx_cpt_ucode_hdr *) fw->data;
 	memcpy(ucode->ver_str, ucode_hdr->ver_str, OTX_CPT_UCODE_VER_STR_SZ);
 	ucode->ver_num = ucode_hdr->ver_num;
-	ucode->size = ntohl(ucode_hdr->code_length) * 2;
-	if (!ucode->size || (fw->size < round_up(ucode->size, 16)
-	    + sizeof(struct otx_cpt_ucode_hdr) + OTX_CPT_UCODE_SIGN_LEN)) {
+	code_length = ntohl(ucode_hdr->code_length);
+	if (code_length >= INT_MAX / 2) {
+		ret = -EINVAL;
+		goto release_fw;
+	}
+	ucode->size = code_length * 2;
+	if (!ucode->size ||
+	    ucode->size > fw->size ||
+	    (fw->size < round_up(ucode->size, 16) +
+	     sizeof(struct otx_cpt_ucode_hdr) + OTX_CPT_UCODE_SIGN_LEN)) {
 		dev_err(dev, "Ucode %s invalid size\n", ucode_filename);
 		ret = -EINVAL;
 		goto release_fw;
-- 
2.35.1