https://github.com/torvalds/linux
Revision 60bb83b81169820c691fbfa33a6a4aef32aa4b0b authored by Takashi Iwai on 13 April 2018, 22:35:13 UTC, committed by Linus Torvalds on 14 April 2018, 00:10:27 UTC
We've got a bug report indicating a kernel panic at booting on an x86-32
system, and it turned out to be the invalid PCI resource assigned after
reallocation.  __find_resource() first aligns the resource start address
and resets the end address with start+size-1 accordingly, then checks
whether it's contained.  Here the end address may overflow the integer,
although resource_contains() still returns true because the function
validates only start and end address.  So this ends up with returning an
invalid resource (start > end).

There was already an attempt to cover such a problem in the commit
47ea91b4052d ("Resource: fix wrong resource window calculation"), but
this case is an overseen one.

This patch adds the validity check of the newly calculated resource for
avoiding the integer overflow problem.

Bugzilla: http://bugzilla.opensuse.org/show_bug.cgi?id=1086739
Link: http://lkml.kernel.org/r/s5hpo37d5l8.wl-tiwai@suse.de
Fixes: 23c570a67448 ("resource: ability to resize an allocated resource")
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Reported-by: Michael Henders <hendersm@shaw.ca>
Tested-by: Michael Henders <hendersm@shaw.ca>
Reviewed-by: Andrew Morton <akpm@linux-foundation.org>
Cc: Ram Pai <linuxram@us.ibm.com>
Cc: Bjorn Helgaas <bhelgaas@google.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
1 parent 16e205c
History
Tip revision: 60bb83b81169820c691fbfa33a6a4aef32aa4b0b authored by Takashi Iwai on 13 April 2018, 22:35:13 UTC
resource: fix integer overflow at reallocation
Tip revision: 60bb83b
File Mode Size
6fire
bcd2000
caiaq
hiface
line6
misc
usx2y
Kconfig -rw-r--r-- 4.6 KB
Makefile -rw-r--r-- 654 bytes
card.c -rw-r--r-- 23.2 KB
card.h -rw-r--r-- 6.6 KB
clock.c -rw-r--r-- 16.2 KB
clock.h -rw-r--r-- 392 bytes
debug.h -rw-r--r-- 301 bytes
endpoint.c -rw-r--r-- 33.0 KB
endpoint.h -rw-r--r-- 1.4 KB
format.c -rw-r--r-- 15.5 KB
format.h -rw-r--r-- 489 bytes
helper.c -rw-r--r-- 3.1 KB
helper.h -rw-r--r-- 1.2 KB
midi.c -rw-r--r-- 68.9 KB
midi.h -rw-r--r-- 1.9 KB
mixer.c -rw-r--r-- 78.6 KB
mixer.h -rw-r--r-- 2.9 KB
mixer_maps.c -rw-r--r-- 14.1 KB
mixer_quirks.c -rw-r--r-- 50.9 KB
mixer_quirks.h -rw-r--r-- 562 bytes
mixer_scarlett.c -rw-r--r-- 28.1 KB
mixer_scarlett.h -rw-r--r-- 208 bytes
mixer_us16x08.c -rw-r--r-- 37.6 KB
mixer_us16x08.h -rw-r--r-- 4.0 KB
pcm.c -rw-r--r-- 47.8 KB
pcm.h -rw-r--r-- 418 bytes
power.h -rw-r--r-- 414 bytes
proc.c -rw-r--r-- 6.0 KB
proc.h -rw-r--r-- 250 bytes
quirks-table.h -rw-r--r-- 79.1 KB
quirks.c -rw-r--r-- 41.9 KB
quirks.h -rw-r--r-- 1.5 KB
stream.c -rw-r--r-- 26.5 KB
stream.h -rw-r--r-- 325 bytes
usbaudio.h -rw-r--r-- 3.5 KB

back to top