Received-SPF: pass (google.com: domain of linux-crypto-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
Date:   Thu, 15 Sep 2022 16:54:54 +0300
From:   Dan Carpenter <dan.carpenter@oracle.com>
To:     Herbert Xu <herbert@gondor.apana.org.au>
Cc:     Boris Brezillon <bbrezillon@kernel.org>,
        Arnaud Ebalard <arno@natisbad.org>,
        Srujana Challa <schalla@marvell.com>,
        "David S. Miller" <davem@davemloft.net>,
        Wolfram Sang <wsa+renesas@sang-engineering.com>,
        Giovanni Cabiddu <giovanni.cabiddu@intel.com>,
        Lukasz Bartosik <lbartosik@marvell.com>,
        linux-crypto@vger.kernel.org, kernel-janitors@vger.kernel.org
Subject: Re: [PATCH] crypto: marvell/octeontx - prevent integer overflows
Message-ID: <YyMurruKJH2TKhAR@kadam>
References: <YxDQeeqY6u5EBn5H@kili>
 <Yxm3MuG+2hMdJSGB@gondor.apana.org.au>
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <Yxm3MuG+2hMdJSGB@gondor.apana.org.au>
MIME-Version: 1.0
X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1
X-MS-Exchange-AntiSpam-MessageData-0: =?us-ascii?Q?qGQME+BKJeKgivE4HL8ejab6+WPqlB25r99dL0fpBi/PUnDqwHlbFNsJduj0?=
 =?us-ascii?Q?YPCHpgfACK/SO/9WYLOJiRY+FnwwKFPxQ3NlWSSytG1kVsYUbzD5ilF71Zyd?=
 =?us-ascii?Q?JBJYmZm66Q/sygSIana2kQ2GwK01fUeR0xV3KEnsAw1NXOLvDnnoCIgv1Z6e?=
 =?us-ascii?Q?nJ6m0cLTjjPMbE/Xjjre0PN3iSi7O5yheqrRLEundXprf3cdH21wOA1wPqyn?=
 =?us-ascii?Q?Ie6SBQeDVzY1pLMguYSwInVwRHrTdulRi5zy9f31i0h88jzaEr6jEM5EKO/p?=
 =?us-ascii?Q?mDkyxB1vWQVQhh5xC7w3xbV/tsWSwSI+OnPHJpz9DOd8nDDBSrDsw6ffnFpE?=
 =?us-ascii?Q?am+sLbDIfQYpGoN0CgOv0cjxh674h4GyL3pzYiXhC2mYA0YLEql/YCLtaipv?=
 =?us-ascii?Q?YMC0rkAFmr85BfLXSyOB+NruFl6iLQ1m3e1M0Y4LpSuMBjbQnPWpCNkPfj00?=
 =?us-ascii?Q?PYwxRKDI7fHqUY4lgBjLDJZXAidb0Npi7V3a0+JYZe3f8kixR7IDWBMw9tPm?=
 =?us-ascii?Q?S/GcxmBnvghqNn6h9qjFtWziYrHKWzGcTG5XsiZnL/GuYz4eMXAF+dg4pOry?=
 =?us-ascii?Q?PaCSGYqMx/9Cb6TvjXPzHYtlb8GvVm8ywOkLyY5j5wp6cD/iEv9B1wLWdgyd?=
 =?us-ascii?Q?duQNZ3mn+knpIGXTuljEYxcnfYGleITbu09nJCln5FxJYOyNNI5EztdGVf43?=
 =?us-ascii?Q?TqnzDT/uy84xJzEfxZrAOsCTJWPUlEYe/IYbsgFAbSIy6OCMP8703LZO/H8Q?=
 =?us-ascii?Q?Rbzp/u+s96xEEHVDFSRKFBPJi6EW7+cXg0gdpTMXm4gkMsuV0LJ+XRJk/f7p?=
 =?us-ascii?Q?gqRzk0C8Z++J84eD1wP7U6Ya3rx3bCAcBT2cFb837zluUGQbSkW0RXrwkGU6?=
 =?us-ascii?Q?H9l0ki4exIAI1g4xz2fr7P9BKlufKdY8F5Rj5T+tcrQHcicKqfe7wsdUg0E5?=
 =?us-ascii?Q?iUmqgO2dXXBB2VMyh4RErItY1EzHXrn2CcuOa2JKyGlVQi2eAmqGMqFQfpeO?=
 =?us-ascii?Q?ulq2tbRv/5WlapaY2WWR16k6OivBl3yU08vyatonzForcuV/F1XB7ZonbPmN?=
 =?us-ascii?Q?MH3FyYwM4SLpDZfbbm8PmmHtJ0qku0A1UKmALWGpc2InOhpsFm6+2zhmPeDa?=
 =?us-ascii?Q?RoTv7/omAHxnv6kjl+oCwGNy5pbkddxg4Ij7UvQW+02wzxE5ytdA62vGo4rN?=
 =?us-ascii?Q?nyzHwAJ9ecEACvePx1W+QR0Cul9X1jkZ/ymEgUBthViJj7J0q3lZ31vF7pRp?=
 =?us-ascii?Q?URRV3klVfkQWlTTFKc/zgCDoZ/aFxrcfi72ABsogvGw+H5qHmeadnf/JiZ+V?=
 =?us-ascii?Q?cMjVhW4K1Xv+RV6Ux0xZ8ty623AU10qDzeF+KjPRwvajJgpWWYvqASNTmDDa?=
 =?us-ascii?Q?jaoXOC00DtnfTy+28N0mgpFcR8fDtdrMDIt7tt5dcCb5FfzrMoYpxSy5IAag?=
 =?us-ascii?Q?SZVTSOsnLmijn57CgVS+oUuq17i9WiqclFNzjoYdei35Z3Tc/2DjnRup1VmD?=
 =?us-ascii?Q?lQc/EzWMJ0CC+FHVFuxov2xlHGOkxYT+4v/Cteo08o9AF23XIQnFTQSnLsUb?=
 =?us-ascii?Q?kHZn4Jn47k3e25rZwS/EiQuRMOfB061GGxW+O8heO9CaeAsgSFgozKRYAHMM?=
 =?us-ascii?Q?Ng=3D=3D?=
X-OriginatorOrg: oracle.com
X-MS-Exchange-CrossTenant-Network-Message-Id: 3b37d890-048e-4096-39a2-08da9721ebbb
X-MS-Exchange-CrossTenant-AuthSource: MWHPR1001MB2365.namprd10.prod.outlook.com
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 15 Sep 2022 13:55:17.2852
 (UTC)
X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted
X-MS-Exchange-CrossTenant-Id: 4e2c6054-71cb-48f1-bd6c-3a9705aca71b
X-MS-Exchange-CrossTenant-MailboxType: HOSTED
X-MS-Exchange-CrossTenant-UserPrincipalName: 4eEnoezZmiJNY9hY5q/QQ6rrl84Yp7Tgg1YambXj9LMPsRGfU4uDEmPJ7RlsYe88rLnnqW7aIoUJh6ZRwP2Sq0xVkFmJazyQlpPigISEjzg=
X-MS-Exchange-Transport-CrossTenantHeadersStamped: SJ0PR10MB5600
X-Proofpoint-Virus-Version: vendor=baseguard
 engine=ICAP:2.0.205,Aquarius:18.0.895,Hydra:6.0.528,FMLib:17.11.122.1
 definitions=2022-09-15_08,2022-09-14_04,2022-06-22_01
X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 spamscore=0 phishscore=0 bulkscore=0
 mlxlogscore=999 mlxscore=0 suspectscore=0 malwarescore=0 adultscore=0
 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2208220000
 definitions=main-2209150081
X-Proofpoint-ORIG-GUID: HzCxYEPdQNJwZO7zsda9pdRQwypyV3zO
X-Proofpoint-GUID: HzCxYEPdQNJwZO7zsda9pdRQwypyV3zO
X-Spam-Status: No, score=-2.8 required=5.0 tests=BAYES_00,DKIM_SIGNED,
        DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,RCVD_IN_DNSWL_LOW,
        RCVD_IN_MSPIKE_H2,SPF_HELO_NONE,SPF_NONE autolearn=ham
        autolearn_force=no version=3.4.6
X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on
        lindbergh.monkeyblade.net
Precedence: bulk
List-ID: <linux-crypto.vger.kernel.org>
X-Mailing-List: linux-crypto@vger.kernel.org

On Thu, Sep 08, 2022 at 05:34:42PM +0800, Herbert Xu wrote:
> On Thu, Sep 01, 2022 at 06:32:09PM +0300, Dan Carpenter wrote:
> >
> > @@ -303,7 +304,13 @@ static int process_tar_file(struct device *dev,
> >  	if (get_ucode_type(ucode_hdr, &ucode_type))
> >  		return 0;
> >  
> > -	ucode_size = ntohl(ucode_hdr->code_length) * 2;
> > +	code_length = ntohl(ucode_hdr->code_length);
> > +	if (code_length >= INT_MAX / 2) {
> > +		dev_err(dev, "Invalid code_length %u\n", code_length);
> > +		return -EINVAL;
> > +	}
> > +
> > +	ucode_size = code_length * 2;
> >  	if (!ucode_size || (size < round_up(ucode_size, 16) +
> >  	    sizeof(struct otx_cpt_ucode_hdr) + OTX_CPT_UCODE_SIGN_LEN)) {
> >  		dev_err(dev, "Ucode %s invalid size\n", filename);
> 
> How come you didn't add a "ucode_size > size" check like you did
> below?
> 

I'm really sorry.  This was not my best work at all.  The ucode_size
was a mistake.  It should have just been the check against INT_MAX.

regards,
dan carpenter