mirror of https://github.com/torvalds/linux.git
7360ee4759
Number of apqn target list entries contained in 'nr_apqns' variable is
determined by userspace via an ioctl call so the result of the product in
calculation of size passed to memdup_user() may overflow.
In this case the actual size of the allocated area and the value
describing it won't be in sync leading to various types of unpredictable
behaviour later.
Use a proper memdup_array_user() helper which returns an error if an
overflow is detected. Note that it is different from when nr_apqns is
initially zero - that case is considered valid and should be handled in
subsequent pkey_handler implementations.
Found by Linux Verification Center (linuxtesting.org).
Fixes:
|
||
|---|---|---|
| .. | ||
| Makefile | ||
| ap_bus.c | ||
| ap_bus.h | ||
| ap_card.c | ||
| ap_debug.h | ||
| ap_queue.c | ||
| pkey_api.c | ||
| pkey_base.c | ||
| pkey_base.h | ||
| pkey_cca.c | ||
| pkey_ep11.c | ||
| pkey_pckmo.c | ||
| pkey_sysfs.c | ||
| pkey_uv.c | ||
| vfio_ap_debug.h | ||
| vfio_ap_drv.c | ||
| vfio_ap_ops.c | ||
| vfio_ap_private.h | ||
| zcrypt_api.c | ||
| zcrypt_api.h | ||
| zcrypt_card.c | ||
| zcrypt_cca_key.h | ||
| zcrypt_ccamisc.c | ||
| zcrypt_ccamisc.h | ||
| zcrypt_cex2a.c | ||
| zcrypt_cex2a.h | ||
| zcrypt_cex2c.c | ||
| zcrypt_cex2c.h | ||
| zcrypt_cex4.c | ||
| zcrypt_cex4.h | ||
| zcrypt_debug.h | ||
| zcrypt_ep11misc.c | ||
| zcrypt_ep11misc.h | ||
| zcrypt_error.h | ||
| zcrypt_msgtype6.c | ||
| zcrypt_msgtype6.h | ||
| zcrypt_msgtype50.c | ||
| zcrypt_msgtype50.h | ||
| zcrypt_queue.c | ||