xen-gntalloc: integer overflow in gntalloc_ioctl_alloc()
Subsystems (3)
PATCH 1/2 xen-gntalloc: integer overflow in gntalloc_ioctl_alloc()
On 32 bit systems a high value of op.count could lead to an integer overflow in the kzalloc() and gref_ids would be smaller than expected. If the you triggered another integer overflow in "if (gref_size + op.count > limit)" then you'd probably get memory corruption inside add_grefs().
Signed-off-by Dan Carpenter <[email protected]>
drivers/xen/gntalloc.c +1 -1
@@ -280,7 +280,7 @@ static long gntalloc_ioctl_alloc(struct gntalloc_file_private_data *priv, goto out; } - gref_ids =kzalloc (sizeof (gref_ids[0 ]) * op.count,GFP_TEMPORARY ); + gref_ids =kcalloc (op.count,sizeof (gref_ids[0 ]),GFP_TEMPORARY );if (!gref_ids) { rc = -ENOMEM ; goto out;
Re: [patch 1/2] xen-gntalloc: integer overflow in
Quoted 7 lines · Dan Carpenter
On 32 bit systems a high value of op.count could lead to an integer overflow in the
kzalloc()andgref_idswould be smaller than expected. If the you triggered another integer overflow in "if (gref_size+ op.count > limit)" then you'd probably get memory corruption insideadd_grefs().Signed-off-by Dan Carpenter <[email protected]>
Great! Keep them coming! Will push for stable and 3.2.
Quoted 14 lines
drivers/xen/gntalloc.c +1
-1@@ -280,7 +280,7 @@ static long gntalloc_ioctl_alloc(struct gntalloc_file_private_data *priv, goto out; } - gref_ids =kzalloc (sizeof (gref_ids[0 ]) * op.count,GFP_TEMPORARY ); + gref_ids =kcalloc (op.count,sizeof (gref_ids[0 ]),GFP_TEMPORARY );if (!gref_ids) { rc = -ENOMEM ; goto out;