Received-SPF: pass (google.com: domain of linux-crypto-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
Date:   Thu, 1 Sep 2022 18:32:53 +0300
From:   Dan Carpenter <dan.carpenter@oracle.com>
To:     George Cherian <gcherian@marvell.com>
Cc:     Herbert Xu <herbert@gondor.apana.org.au>,
        "David S. Miller" <davem@davemloft.net>,
        David Daney <david.daney@cavium.com>,
        linux-crypto@vger.kernel.org, kernel-janitors@vger.kernel.org
Subject: [PATCH] crypto: cavium - prevent integer overflow loading firmware
Message-ID: <YxDQpc9IINUuUhQr@kili>
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
MIME-Version: 1.0
X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1
X-MS-Exchange-AntiSpam-MessageData-0: =?us-ascii?Q?rhN2ndU/DbipFg2mSWDpLyItZYtsOHuNL5UEmc3VPf/UIycbVpRL0vInndGe?=
 =?us-ascii?Q?hgfUpsSGUP09dZmegu/n7AF1k4xOP2k1c4BXG8cKLd1ZF0CErJ1Xlg7uyXAQ?=
 =?us-ascii?Q?5HMG9BXzkz+tFXui8ow1sxIV35cIj5d+7xkkaRR5Mj/qkeX+5zxhmrecjPv2?=
 =?us-ascii?Q?ZP4ryBZ6kJll+K+8QnQKVupEzvoO54Pv7ZWaeu2k/RBLAW6F9dNmolLU86+E?=
 =?us-ascii?Q?c8FaougYl2a9I6xcTT5zZZSQTqEVrfyjQ9/zaBBV/bwNoYCXd1ej0HXF/pXz?=
 =?us-ascii?Q?ga7ovKVjuWDTqpyh5+EEUsGcY8DJ0GBE18wg/FLykBUg/S9kYGKLQ2wKCUzC?=
 =?us-ascii?Q?4UoiaNWrAVQMPQzY9951fj/cyHgGiHjoK5kz5AviUGoHkXOlyeKWp2gcxngA?=
 =?us-ascii?Q?RUYNoU5XxLqOyXaQMXVRSZOphL4u+9WkaW3Wn+pYPJqsqJQHaedyQRjqTG4a?=
 =?us-ascii?Q?3ezPfw1L5YvjXylw4MBlST+HnIboRycTVdV4wF41ydQyoGPf0JmO9NPyob8O?=
 =?us-ascii?Q?aUxpw2QCWWrFoOLX1eZ+32PviEOEKC2O+EkzPWpV78X5Rt+JLQHqeQyJk9u+?=
 =?us-ascii?Q?Nt2wj7XcmwM3MYcPfJ7bqPOpyMUGXYid+c09wLbecWjL976EBWDjm2G5OULE?=
 =?us-ascii?Q?SfOLjXbMD1Pcx2RrlJtt+asJDhcOg9gubP8rFd489yCWnZCz8fEXdZ9cWnPT?=
 =?us-ascii?Q?pEfhGHgC0/937RkdADYwY2T2YdCtOd8eMcDJIG0eDFg5cYZXuEAkOp1xaK+l?=
 =?us-ascii?Q?MZ1ubGCA2RKy+U8p2E1XtJ4/MGRPznOsqBIkXZ9uqDwhycSNpdlhX+Ur995S?=
 =?us-ascii?Q?WUyUeADB4A3eiBuoGIdchZ6qD7sO3/56i2u+qK4waG3sGhjLzTTyXgM47e95?=
 =?us-ascii?Q?sr2EJDeiPJqObBoCeCXqxAofjqbMO0xtfEmBooc5KEKsriVZPuTh8g7K2LyL?=
 =?us-ascii?Q?l0BQLcpaDEF2I/rBvzKEbiP3iI+Xvz4dxfRCjlMN3HVKMj+p9nd+IdhxfrZ/?=
 =?us-ascii?Q?8rg9T18Rqh0SsI1Xr/qt6MqUdJS/FRr5tYuOSj7Y/Ugs2KGUP6ErUto5YlxP?=
 =?us-ascii?Q?E4ycNkEAS/MJEYFG69uj+MOCNR4WPn92wNSA/acKUwhk6ASjcNCIXBLINbzQ?=
 =?us-ascii?Q?52cIhKKTK1dNfgXQ6NABaYa00krIJ99esC9zeMuyAwq9Vh37qNl3NLIS9lZu?=
 =?us-ascii?Q?qPmGqaChIYePFlzCP9FqTSXzErGaDRAPkvc+D/1Z8/80Xux3UjJR083CAGvs?=
 =?us-ascii?Q?kKty2cNDiSRMUjbq8PeU+0VjZzANPwhO6t+dLp/DVJSV7iu14dIBRMtR8k9I?=
 =?us-ascii?Q?nGki/J24aMOSKUvn4DwHTk5Y7h6NN+YBzczUGTFi2psDwe9pZuSXiImv4QlB?=
 =?us-ascii?Q?SsXz3zGQrOTYkwpVN2/DNw+2UyAm2DEx2qjtvBlpfTGP0ZSY4B9F8GCvHtUL?=
 =?us-ascii?Q?LT2w9mEurZeGGOMrVBdi0BbnTHwW7Y/jQu960kDc1emTzD66w6+6B3aPjgYs?=
 =?us-ascii?Q?n0DDjFSin6379FM7ehsZCaBHh9QIosanNegBKJiXn3zJTY5SiyE3ZDJBkSj5?=
 =?us-ascii?Q?nOef7okmQcHInT8Dtbmb+5u6WNRZ+GXgzmZ+bY75Lwv98jsOWeGpwFb+Z8SY?=
 =?us-ascii?Q?bA=3D=3D?=
X-OriginatorOrg: oracle.com
X-MS-Exchange-CrossTenant-Network-Message-Id: f6202e45-2fa5-4294-5cdb-08da8c2f42d7
X-MS-Exchange-CrossTenant-AuthSource: MWHPR1001MB2365.namprd10.prod.outlook.com
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 01 Sep 2022 15:33:04.0358
 (UTC)
X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted
X-MS-Exchange-CrossTenant-Id: 4e2c6054-71cb-48f1-bd6c-3a9705aca71b
X-MS-Exchange-CrossTenant-MailboxType: HOSTED
X-MS-Exchange-CrossTenant-UserPrincipalName: X4k9heirNOzh0wx12jVMb5pCccSU544uixoNpoEJ9FdtmbsvIs/oQqRjUoQ8dezF0ndXLoQeLGWosfFOs5BN0A73tdVsjXdoid5Q6TAV+/M=
X-MS-Exchange-Transport-CrossTenantHeadersStamped: MN2PR10MB4144
X-Proofpoint-Virus-Version: vendor=baseguard
 engine=ICAP:2.0.205,Aquarius:18.0.895,Hydra:6.0.517,FMLib:17.11.122.1
 definitions=2022-09-01_10,2022-08-31_03,2022-06-22_01
X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 malwarescore=0 suspectscore=0
 mlxlogscore=999 adultscore=0 phishscore=0 spamscore=0 bulkscore=0
 mlxscore=0 classifier=spam adjust=0 reason=mlx scancount=1
 engine=8.12.0-2207270000 definitions=main-2209010070
X-Proofpoint-GUID: 0rUJ-G-mu05iGol99emaV5sAYkYxv3VJ
X-Proofpoint-ORIG-GUID: 0rUJ-G-mu05iGol99emaV5sAYkYxv3VJ
X-Spam-Status: No, score=-2.8 required=5.0 tests=BAYES_00,DKIM_SIGNED,
        DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,RCVD_IN_DNSWL_LOW,
        RCVD_IN_MSPIKE_H2,SPF_HELO_NONE,SPF_NONE,T_SCC_BODY_TEXT_LINE
        autolearn=ham autolearn_force=no version=3.4.6
X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on
        lindbergh.monkeyblade.net
Precedence: bulk
List-ID: <linux-crypto.vger.kernel.org>
X-Mailing-List: linux-crypto@vger.kernel.org

The "ntohl(ucode->code_length) * 2" multiplication can have an
integer overflow.

Fixes: 9e2c7d99941d ("crypto: cavium - Add Support for Octeon-tx CPT Engine")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
---
 drivers/crypto/cavium/cpt/cptpf_main.c | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/drivers/crypto/cavium/cpt/cptpf_main.c b/drivers/crypto/cavium/cpt/cptpf_main.c
index 8c32d0eb8fcf..b196579dcd98 100644
--- a/drivers/crypto/cavium/cpt/cptpf_main.c
+++ b/drivers/crypto/cavium/cpt/cptpf_main.c
@@ -253,6 +253,7 @@ static int cpt_ucode_load_fw(struct cpt_device *cpt, const u8 *fw, bool is_ae)
 	const struct firmware *fw_entry;
 	struct device *dev = &cpt->pdev->dev;
 	struct ucode_header *ucode;
+	unsigned int code_length;
 	struct microcode *mcode;
 	int j, ret = 0;
 
@@ -263,7 +264,13 @@ static int cpt_ucode_load_fw(struct cpt_device *cpt, const u8 *fw, bool is_ae)
 	ucode = (struct ucode_header *)fw_entry->data;
 	mcode = &cpt->mcode[cpt->next_mc_idx];
 	memcpy(mcode->version, (u8 *)fw_entry->data, CPT_UCODE_VERSION_SZ);
-	mcode->code_size = ntohl(ucode->code_length) * 2;
+
+	code_length = ntohl(ucode->code_length);
+	if (code_length >= INT_MAX / 2) {
+		ret = -EINVAL;
+		goto fw_release;
+	}
+	mcode->code_size = code_length;
 	if (!mcode->code_size) {
 		ret = -EINVAL;
 		goto fw_release;
-- 
2.35.1