diff options
| author | Takashi Iwai <tiwai@suse.de> | 2018-04-13 15:35:13 -0700 |
|---|---|---|
| committer | Sasha Levin <alexander.levin@microsoft.com> | 2018-05-22 21:36:32 -0400 |
| commit | 87b58ea3bd75d32b41239afa53d95e42c744cfac (patch) | |
| tree | 703cc2ca2ca0d2ad3556b9fb3e04278e3c64609b | |
| parent | 0f90b6653c9c80cdbdcc4467280fb51bf76251cb (diff) | |
resource: fix integer overflow at reallocation
[ Upstream commit 60bb83b81169820c691fbfa33a6a4aef32aa4b0b ]
We've got a bug report indicating a kernel panic at booting on an x86-32
system, and it turned out to be the invalid PCI resource assigned after
reallocation. __find_resource() first aligns the resource start address
and resets the end address with start+size-1 accordingly, then checks
whether it's contained. Here the end address may overflow the integer,
although resource_contains() still returns true because the function
validates only start and end address. So this ends up with returning an
invalid resource (start > end).
There was already an attempt to cover such a problem in the commit
47ea91b4052d ("Resource: fix wrong resource window calculation"), but
this case is an overseen one.
This patch adds the validity check of the newly calculated resource for
avoiding the integer overflow problem.
Bugzilla: http://bugzilla.opensuse.org/show_bug.cgi?id=1086739
Link: http://lkml.kernel.org/r/s5hpo37d5l8.wl-tiwai@suse.de
Fixes: 23c570a67448 ("resource: ability to resize an allocated resource")
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Reported-by: Michael Henders <hendersm@shaw.ca>
Tested-by: Michael Henders <hendersm@shaw.ca>
Reviewed-by: Andrew Morton <akpm@linux-foundation.org>
Cc: Ram Pai <linuxram@us.ibm.com>
Cc: Bjorn Helgaas <bhelgaas@google.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
| -rw-r--r-- | kernel/resource.c | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/kernel/resource.c b/kernel/resource.c index cbf725c24c3b..39ee5aeaf1e3 100644 --- a/kernel/resource.c +++ b/kernel/resource.c @@ -600,7 +600,8 @@ static int __find_resource(struct resource *root, struct resource *old, alloc.start = constraint->alignf(constraint->alignf_data, &avail, size, constraint->align); alloc.end = alloc.start + size - 1; - if (resource_contains(&avail, &alloc)) { + if (alloc.start <= alloc.end && + resource_contains(&avail, &alloc)) { new->start = alloc.start; new->end = alloc.end; return 0; |