Patch "spi: spidev: fix possible arithmetic overflow for multi-transfer message" has been added to the 3.14-stable tree

This is a note to let you know that I've just added the patch titled

spi: spidev: fix possible arithmetic overflow for multi-transfer message

to the 3.14-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
spi-spidev-fix-possible-arithmetic-overflow-for-multi-transfer-message.patch
and it can be found in the queue-3.14 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree, please let <[email protected]> know about it.

From: Ian Abbott <[email protected]>
Date: Mon, 23 Mar 2015 17:50:27 +0000
Subject: spi: spidev: fix possible arithmetic overflow for multi-transfer message

From: Ian Abbott <[email protected]>

commit f20fbaad7620af2df36a1f9d1c9ecf48ead5b747 upstream.

spidev_message() sums the lengths of the individual SPI transfers to determine the overall SPI message length. It restricts the total length, returning an error if too long, but it does not check for arithmetic overflow. For example, if the SPI message consisted of two transfers and the first has a length of 10 and the second has a length of (__u32)(-1), the total length would be seen as 9, even though the second transfer is actually very long. If the second transfer specifies a null rx_buf and a non-null tx_buf, the copy_from_user() could overrun the spidev's pre-allocated tx buffer before it reaches an invalid user memory address. Fix it by checking that neither the total nor the individual transfer lengths exceed the maximum allowed value.

Thanks to Dan Carpenter for reporting the potential integer overflow.

---
 drivers/spi/spidev.c |    5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

@@ -243,7 +243,10 @@ static int spidev_message(struct spidev_
 		k_tmp->len = u_tmp->len;
 
 		total += k_tmp->len;
-		if (total > bufsiz) {
+		/* Check total length of transfers.  Also check each
+		 * transfer length to avoid arithmetic overflow.
+		 */
+		if (total > bufsiz || k_tmp->len > bufsiz) {
 			status = -EMSGSIZE;
 			goto done;
 		}

Patches currently in stable-queue which might be from [email protected] are

queue-3.14/spi-spidev-fix-possible-arithmetic-overflow-for-multi-transfer-message.patch