* [PATCH] fpga: dfl-afu-region: Add overflow checks for region size and offset
@ 2023-02-06 5:43 k1rh4.lee
2023-02-06 16:50 ` Russ Weight
2023-02-10 8:21 ` Xu Yilun
0 siblings, 2 replies; 5+ messages in thread
From: k1rh4.lee @ 2023-02-06 5:43 UTC (permalink / raw)
To: Wu Hao
Cc: Tom Rix, Moritz Fischer, Xu Yilun, linux-fpga, linux-kernel, Sangsup Lee
From: Sangsup Lee <k1rh4.lee@gmail.com>
The size + offset is able to be integer overflow value and it lead to mis-allocate region.
Signed-off-by: Sangsup Lee <k1rh4.lee@gmail.com>
---
drivers/fpga/dfl-afu-region.c | 7 ++++++-
1 file changed, 6 insertions(+), 1 deletion(-)
diff --git a/drivers/fpga/dfl-afu-region.c b/drivers/fpga/dfl-afu-region.c
index 2e7b41629406..82b530111601 100644
--- a/drivers/fpga/dfl-afu-region.c
+++ b/drivers/fpga/dfl-afu-region.c
@@ -151,12 +151,17 @@ int afu_mmio_region_get_by_offset(struct dfl_feature_platform_data *pdata,
struct dfl_afu_mmio_region *region;
struct dfl_afu *afu;
int ret = 0;
+ u64 region_size = 0;
mutex_lock(&pdata->lock);
+ if (check_add_overflow(offset, size, ®ion_size)) {
+ ret = -EINVAL;
+ goto exit;
+ }
afu = dfl_fpga_pdata_get_private(pdata);
for_each_region(region, afu)
if (region->offset <= offset &&
- region->offset + region->size >= offset + size) {
+ region->offset + region->size >= region_size) {
*pregion = *region;
goto exit;
}
--
2.25.1
^ permalink raw reply related [flat|nested] 5+ messages in thread
* Re: [PATCH] fpga: dfl-afu-region: Add overflow checks for region size and offset
2023-02-06 5:43 [PATCH] fpga: dfl-afu-region: Add overflow checks for region size and offset k1rh4.lee
@ 2023-02-06 16:50 ` Russ Weight
2023-02-10 8:21 ` Xu Yilun
1 sibling, 0 replies; 5+ messages in thread
From: Russ Weight @ 2023-02-06 16:50 UTC (permalink / raw)
To: k1rh4.lee, Wu Hao
Cc: Tom Rix, Moritz Fischer, Xu Yilun, linux-fpga, linux-kernel
On 2/5/23 21:43, k1rh4.lee@gmail.com wrote:
> From: Sangsup Lee <k1rh4.lee@gmail.com>
>
> The size + offset is able to be integer overflow value and it lead to mis-allocate region.
Reviewed-by: Russ Weight <russell.h.weight@intel.com>
> Signed-off-by: Sangsup Lee <k1rh4.lee@gmail.com>
> ---
> drivers/fpga/dfl-afu-region.c | 7 ++++++-
> 1 file changed, 6 insertions(+), 1 deletion(-)
>
> diff --git a/drivers/fpga/dfl-afu-region.c b/drivers/fpga/dfl-afu-region.c
> index 2e7b41629406..82b530111601 100644
> --- a/drivers/fpga/dfl-afu-region.c
> +++ b/drivers/fpga/dfl-afu-region.c
> @@ -151,12 +151,17 @@ int afu_mmio_region_get_by_offset(struct dfl_feature_platform_data *pdata,
> struct dfl_afu_mmio_region *region;
> struct dfl_afu *afu;
> int ret = 0;
> + u64 region_size = 0;
>
> mutex_lock(&pdata->lock);
> + if (check_add_overflow(offset, size, ®ion_size)) {
> + ret = -EINVAL;
> + goto exit;
> + }
> afu = dfl_fpga_pdata_get_private(pdata);
> for_each_region(region, afu)
> if (region->offset <= offset &&
> - region->offset + region->size >= offset + size) {
> + region->offset + region->size >= region_size) {
> *pregion = *region;
> goto exit;
> }
^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: [PATCH] fpga: dfl-afu-region: Add overflow checks for region size and offset
2023-02-06 5:43 [PATCH] fpga: dfl-afu-region: Add overflow checks for region size and offset k1rh4.lee
2023-02-06 16:50 ` Russ Weight
@ 2023-02-10 8:21 ` Xu Yilun
2023-04-09 19:00 ` Salvatore Bonaccorso
1 sibling, 1 reply; 5+ messages in thread
From: Xu Yilun @ 2023-02-10 8:21 UTC (permalink / raw)
To: k1rh4.lee; +Cc: Wu Hao, Tom Rix, Moritz Fischer, linux-fpga, linux-kernel
On 2023-02-05 at 21:43:26 -0800, k1rh4.lee@gmail.com wrote:
> From: Sangsup Lee <k1rh4.lee@gmail.com>
>
> The size + offset is able to be integer overflow value and it lead to mis-allocate region.
But I didn't see the memory allocation.
>
> Signed-off-by: Sangsup Lee <k1rh4.lee@gmail.com>
> ---
> drivers/fpga/dfl-afu-region.c | 7 ++++++-
> 1 file changed, 6 insertions(+), 1 deletion(-)
>
> diff --git a/drivers/fpga/dfl-afu-region.c b/drivers/fpga/dfl-afu-region.c
> index 2e7b41629406..82b530111601 100644
> --- a/drivers/fpga/dfl-afu-region.c
> +++ b/drivers/fpga/dfl-afu-region.c
> @@ -151,12 +151,17 @@ int afu_mmio_region_get_by_offset(struct dfl_feature_platform_data *pdata,
> struct dfl_afu_mmio_region *region;
> struct dfl_afu *afu;
> int ret = 0;
> + u64 region_size = 0;
Reverse Xmax tree please.
>
> mutex_lock(&pdata->lock);
> + if (check_add_overflow(offset, size, ®ion_size)) {
I'm not sure if the check is necessary.
The offset comes from: offset = vma->vm_pgoff << PAGE_SHIFT
The size comes from: size = vma->vm_end - vma->vm_start
Is it possible the upper mm layer passes invalid vma?
Thanks,
Yilun
> + ret = -EINVAL;
> + goto exit;
> + }
> afu = dfl_fpga_pdata_get_private(pdata);
> for_each_region(region, afu)
> if (region->offset <= offset &&
> - region->offset + region->size >= offset + size) {
> + region->offset + region->size >= region_size) {
> *pregion = *region;
> goto exit;
> }
> --
> 2.25.1
>
^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: [PATCH] fpga: dfl-afu-region: Add overflow checks for region size and offset
2023-02-10 8:21 ` Xu Yilun
@ 2023-04-09 19:00 ` Salvatore Bonaccorso
2023-04-10 2:17 ` sangsup lee
0 siblings, 1 reply; 5+ messages in thread
From: Salvatore Bonaccorso @ 2023-04-09 19:00 UTC (permalink / raw)
To: Xu Yilun, Sangsup Lee
Cc: k1rh4.lee, Wu Hao, Tom Rix, Moritz Fischer, linux-fpga, linux-kernel
Hi,
On Fri, Feb 10, 2023 at 04:21:37PM +0800, Xu Yilun wrote:
> On 2023-02-05 at 21:43:26 -0800, k1rh4.lee@gmail.com wrote:
> > From: Sangsup Lee <k1rh4.lee@gmail.com>
> >
> > The size + offset is able to be integer overflow value and it lead to mis-allocate region.
>
> But I didn't see the memory allocation.
>
> >
> > Signed-off-by: Sangsup Lee <k1rh4.lee@gmail.com>
> > ---
> > drivers/fpga/dfl-afu-region.c | 7 ++++++-
> > 1 file changed, 6 insertions(+), 1 deletion(-)
> >
> > diff --git a/drivers/fpga/dfl-afu-region.c b/drivers/fpga/dfl-afu-region.c
> > index 2e7b41629406..82b530111601 100644
> > --- a/drivers/fpga/dfl-afu-region.c
> > +++ b/drivers/fpga/dfl-afu-region.c
> > @@ -151,12 +151,17 @@ int afu_mmio_region_get_by_offset(struct dfl_feature_platform_data *pdata,
> > struct dfl_afu_mmio_region *region;
> > struct dfl_afu *afu;
> > int ret = 0;
> > + u64 region_size = 0;
>
> Reverse Xmax tree please.
>
> >
> > mutex_lock(&pdata->lock);
> > + if (check_add_overflow(offset, size, ®ion_size)) {
>
> I'm not sure if the check is necessary.
>
> The offset comes from: offset = vma->vm_pgoff << PAGE_SHIFT
> The size comes from: size = vma->vm_end - vma->vm_start
> Is it possible the upper mm layer passes invalid vma?
>
> Thanks,
> Yilun
Did you saw the comments on your patch by Yilun? Did it felt trough
the cracks?
Regards,
Salvatore
^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: [PATCH] fpga: dfl-afu-region: Add overflow checks for region size and offset
2023-04-09 19:00 ` Salvatore Bonaccorso
@ 2023-04-10 2:17 ` sangsup lee
0 siblings, 0 replies; 5+ messages in thread
From: sangsup lee @ 2023-04-10 2:17 UTC (permalink / raw)
To: Salvatore Bonaccorso
Cc: Xu Yilun, Wu Hao, Tom Rix, Moritz Fischer, linux-fpga, linux-kernel
Hi,
In my opinion the code has an insecure code pattern.
The size may have integer overflow condition i think.
But, I did not do dynamic analysis but I did static audit fpga code(I
don't have an fpga device).
because of this. I don't make sure about Yilun's comment.
I think the code must have defensive coding rules.
best regards.
^ permalink raw reply [flat|nested] 5+ messages in thread
end of thread, other threads:[~2023-04-10 2:19 UTC | newest]
Thread overview: 5+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2023-02-06 5:43 [PATCH] fpga: dfl-afu-region: Add overflow checks for region size and offset k1rh4.lee
2023-02-06 16:50 ` Russ Weight
2023-02-10 8:21 ` Xu Yilun
2023-04-09 19:00 ` Salvatore Bonaccorso
2023-04-10 2:17 ` sangsup lee
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).