From patchwork Fri May 9 11:54:37 2014 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Dan Carpenter X-Patchwork-Id: 347390 X-Patchwork-Delegate: davem@davemloft.net Return-Path: X-Original-To: patchwork-incoming@ozlabs.org Delivered-To: patchwork-incoming@ozlabs.org Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by ozlabs.org (Postfix) with ESMTP id D8BD3140105 for ; Fri, 9 May 2014 21:55:01 +1000 (EST) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1754913AbaEILy6 (ORCPT ); Fri, 9 May 2014 07:54:58 -0400 Received: from userp1040.oracle.com ([156.151.31.81]:39994 "EHLO userp1040.oracle.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1754041AbaEILy5 (ORCPT ); Fri, 9 May 2014 07:54:57 -0400 Received: from ucsinet22.oracle.com (ucsinet22.oracle.com [156.151.31.94]) by userp1040.oracle.com (Sentrion-MTA-4.3.2/Sentrion-MTA-4.3.2) with ESMTP id s49BsqEW009466 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=OK); Fri, 9 May 2014 11:54:52 GMT Received: from userz7022.oracle.com (userz7022.oracle.com [156.151.31.86]) by ucsinet22.oracle.com (8.14.5+Sun/8.14.5) with ESMTP id s49Bsp40010896 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO); Fri, 9 May 2014 11:54:52 GMT Received: from abhmp0014.oracle.com (abhmp0014.oracle.com [141.146.116.20]) by userz7022.oracle.com (8.14.5+Sun/8.14.4) with ESMTP id s49BsoKK010831; Fri, 9 May 2014 11:54:50 GMT Received: from mwanda (/197.157.0.6) by default (Oracle Beehive Gateway v4.0) with ESMTP ; Fri, 09 May 2014 04:54:49 -0700 Date: Fri, 9 May 2014 14:54:37 +0300 From: Dan Carpenter To: Karsten Keil Cc: netdev@vger.kernel.org, security@kernel.org, Henry Hoggard Subject: [patch] isdn: avm: potential signedness issue in loading firmware Message-ID: <20140509115437.GA31764@mwanda> MIME-Version: 1.0 Content-Disposition: inline In-Reply-To: <20140509102724.GF4963@mwanda> User-Agent: Mutt/1.5.21 (2010-09-15) X-Source-IP: ucsinet22.oracle.com [156.151.31.94] Sender: netdev-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: netdev@vger.kernel.org The concern here is that a negative value for "len" could lead underflow the "while (left > FWBUF_SIZE) {" test and lead to memory corruption. I do not believe this is possible because we test for negatives in old_capi_manufacturer(), "if (ldef.t4file.len <= 0) {". But it sort of makes the code nicer to only deal with positive lengths so I have made it unsigned. The length is still not capped and so if we get a too large value, we keep on writing it out to the firmware byte by byte until the writes start failing. Loading the firmware requires CAP_SYS_ADMIN. Reported-by: Henry Hoggard Signed-off-by: Dan Carpenter --- To unsubscribe from this list: send the line "unsubscribe netdev" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html diff --git a/drivers/isdn/hardware/avm/b1.c b/drivers/isdn/hardware/avm/b1.c index 4d9b195..7f2ed49 100644 --- a/drivers/isdn/hardware/avm/b1.c +++ b/drivers/isdn/hardware/avm/b1.c @@ -153,7 +153,8 @@ int b1_load_t4file(avmcard *card, capiloaddatapart *t4file) { unsigned char buf[FWBUF_SIZE]; unsigned char *dp; - int i, left; + unsigned int left; + int i; unsigned int base = card->port; dp = t4file->data;