From patchwork Sat Jul 7 03:37:22 2018 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Jann Horn X-Patchwork-Id: 940745 X-Patchwork-Delegate: boris.brezillon@free-electrons.com Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@bilbo.ozlabs.org Authentication-Results: ozlabs.org; spf=none (mailfrom) smtp.mailfrom=lists.infradead.org (client-ip=2607:7c80:54:e::133; helo=bombadil.infradead.org; envelope-from=linux-mtd-bounces+incoming=patchwork.ozlabs.org@lists.infradead.org; receiver=) Authentication-Results: ozlabs.org; dmarc=fail (p=reject dis=none) header.from=google.com Authentication-Results: ozlabs.org; dkim=pass (2048-bit key; unprotected) header.d=lists.infradead.org header.i=@lists.infradead.org header.b="aWkI7jad"; dkim=fail reason="signature verification failed" (2048-bit key; unprotected) header.d=google.com header.i=@google.com header.b="lQdtMGBF"; dkim-atps=neutral Received: from bombadil.infradead.org (bombadil.infradead.org [IPv6:2607:7c80:54:e::133]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ozlabs.org (Postfix) with ESMTPS id 41My431qpVz9rxs for ; Sat, 7 Jul 2018 13:38:27 +1000 (AEST) DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.infradead.org; s=bombadil.20170209; h=Sender: Content-Transfer-Encoding:Content-Type:Cc:List-Subscribe:List-Help:List-Post: List-Archive:List-Unsubscribe:List-Id:To:From:Subject:Message-Id:Date: MIME-Version:Reply-To:Content-ID:Content-Description:Resent-Date:Resent-From: Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:In-Reply-To:References: List-Owner; bh=FK7P2zOYceoJrWDe2iYb7hxSGVzhF+MAbmrPCmUIoW8=; b=aWkI7jadWF86bq XoOQUac8TnDHAj8gFQ43Edhi03ufnQHf/0DaGZGOjpyfUbKRobEBjClqa3dzDmsRD/MPFYcWSQerW tmbcRORWeENE7S0DfP7R6WCyFzx2QdyOKi7b7qut61gOj3EXq2jJW4sMaFKUErotnUazDUxcOWJcb XbIZRVDt2TAJQTX9mUqpfNmDlrD0QZcm2Byr65mzvM+8mmCZIKMgOz1ygSJIX4b7oAgpkmhRxDfZ0 4Fp3Gt2r1NI7yOolJpPHkYSgXneIwD+6CavCo9XHV3rhdjS0EDvlgrE2ys0DNH8HFXC96mlEWJWqC oug65hKRFOYoBWtD4zfg==; Received: from localhost ([127.0.0.1] helo=bombadil.infradead.org) by bombadil.infradead.org with esmtp (Exim 4.90_1 #2 (Red Hat Linux)) id 1fbe38-0003mW-6A; Sat, 07 Jul 2018 03:38:18 +0000 Received: from mail-yb0-x24a.google.com ([2607:f8b0:4002:c09::24a]) by bombadil.infradead.org with esmtps (Exim 4.90_1 #2 (Red Hat Linux)) id 1fbe35-0003kk-8A for linux-mtd@lists.infradead.org; Sat, 07 Jul 2018 03:38:16 +0000 Received: by mail-yb0-x24a.google.com with SMTP id y10-v6so11182610ybj.20 for ; Fri, 06 Jul 2018 20:38:03 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20161025; h=mime-version:date:message-id:subject:from:to:cc; bh=xwRfAR8R1iMce9FKNfNsdxRX8PFHVpGWUGEPMPwjt6Q=; b=lQdtMGBFUJyF0qmOKtEgFTek8nmGp5hMFT4dDbWIYWJp4vH7jWOpOVZDDBjPU5kovb n0X45lvB1edIJQk/hM3w1A9EmcqSJ/555KRfhPpr7agkyTjDPI5hDP/oz1RJ0UBD2LPZ x7z+FlhCr7xC5H1PyU553lzHiJW95ndYwDgDg5jgbvzRM1pSzpP9bn+iWKui40rb1U53 JM9ZEDvybe2noGCvoC3siN7V43NvgyRVM8ICLUoXpf3irziEIoxG1GHhoq6r4le2Ff+8 NF5/au8ES/iSPu3mz58/qg7YrhumwC+UlIC6Ktydnw2PgSNtV71gwehGzObgoK/A2IlI SmYw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:date:message-id:subject:from:to:cc; bh=xwRfAR8R1iMce9FKNfNsdxRX8PFHVpGWUGEPMPwjt6Q=; b=qRWZYag/dRWWdng/7Ucv3FiJXSyXcvDxTmdqsyM2VFsK53elCwnJBTTtZ3Roj/kYzW unSjrmtxqRGZMJcXBZGmmgkIHjr+GWo2mhU2X34X/lPZ3YEf4OdqaXEgQYmero6iOQ71 xU4+RSAGc/JJ0SN/hkA8XJVEb+n2Jxzfj9TlkOjaEa0TEIPI++1vxFP/YpntEsfBQJan qyWfZt5/cpK9wi42oG0/2MiScACs/oRzTogCWcXkrOl3w98HDhUCk3wXLmy+pmAPNfPK dZX/hnc73Psf8nMVtiTZgFMcTIQjtjfw7FZRGtKYt75LhHbHs16uCh+bt7glXMNSreSK o4ng== X-Gm-Message-State: APt69E14z243Mal0Szr1WBiXgB9lLSP+On7PFqDfFqjbCrjMK8nK6WGF 2ugAO5nB4/uthMlUQpZUH1wKcx3e3A== X-Google-Smtp-Source: AAOMgpd+okfJm07IlT2WMlgufMnTQikIfMT8mMDjcRwe6atfO+I37EQ2E7psR5sgRHaqZMFSKZa/Y2xgiw== MIME-Version: 1.0 X-Received: by 2002:a81:5555:: with SMTP id j82-v6mr3874405ywb.132.1530934683053; Fri, 06 Jul 2018 20:38:03 -0700 (PDT) Date: Sat, 7 Jul 2018 05:37:22 +0200 Message-Id: <20180707033722.219468-1-jannh@google.com> X-Mailer: git-send-email 2.18.0.203.gfac676dfb9-goog Subject: [PATCH] mtdchar: fix overflows in adjustment of `count` From: Jann Horn To: David Woodhouse , Brian Norris , Boris Brezillon , Marek Vasut , Richard Weinberger , jannh@google.com X-CRM114-Version: 20100106-BlameMichelson ( TRE 0.8.0 (BSD) ) MR-646709E3 X-CRM114-CacheID: sfid-20180706_203815_315454_9AD7A1C5 X-CRM114-Status: GOOD ( 15.05 ) X-Spam-Score: -7.6 (-------) X-Spam-Report: SpamAssassin version 3.4.1 on bombadil.infradead.org summary: Content analysis details: (-7.6 points) pts rule name description ---- ---------------------- -------------------------------------------------- -0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no trust [2607:f8b0:4002:c09:0:0:0:24a listed in] [list.dnswl.org] -0.0 SPF_PASS SPF: sender matches SPF record -7.5 USER_IN_DEF_DKIM_WL From: address is in the default DKIM white-list -0.1 DKIM_VALID_AU Message has a valid DKIM or DK signature from author's domain 0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid -0.1 DKIM_VALID Message has at least one valid DKIM or DK signature -0.0 T_DKIMWL_WL_MED DKIMwl.org - Whitelisted Medium sender X-BeenThere: linux-mtd@lists.infradead.org X-Mailman-Version: 2.1.21 Precedence: list List-Id: Linux MTD discussion mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: linux-mtd@lists.infradead.org, linux-kernel@vger.kernel.org Sender: "linux-mtd" Errors-To: linux-mtd-bounces+incoming=patchwork.ozlabs.org@lists.infradead.org The first checks in mtdchar_read() and mtdchar_write() attempt to limit `count` such that `*ppos + count <= mtd->size`. However, they ignore the possibility of `*ppos > mtd->size`, allowing the calculation of `count` to wrap around. `mtdchar_lseek()` prevents seeking beyond mtd->size, but the pread/pwrite syscalls bypass this. I haven't found any codepath on which this actually causes dangerous behavior, but it seems like a sensible change anyway. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Signed-off-by: Jann Horn --- drivers/mtd/mtdchar.c | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-) diff --git a/drivers/mtd/mtdchar.c b/drivers/mtd/mtdchar.c index cd67c85cc87d..02389528f622 100644 --- a/drivers/mtd/mtdchar.c +++ b/drivers/mtd/mtdchar.c @@ -160,8 +160,12 @@ static ssize_t mtdchar_read(struct file *file, char __user *buf, size_t count, pr_debug("MTD_read\n"); - if (*ppos + count > mtd->size) - count = mtd->size - *ppos; + if (*ppos + count > mtd->size) { + if (*ppos < mtd->size) + count = mtd->size - *ppos; + else + count = 0; + } if (!count) return 0; @@ -246,7 +250,7 @@ static ssize_t mtdchar_write(struct file *file, const char __user *buf, size_t c pr_debug("MTD_write\n"); - if (*ppos == mtd->size) + if (*ppos >= mtd->size) return -ENOSPC; if (*ppos + count > mtd->size)