Skip to contentSkip to conversation

fpga: prevent integer overflow in dfl_feature_ioctl_set_irq()

PATCH Applied Dan Carpenter 2 participants 2 messages Sep 1, 2022 – Sep 3, 2022

Subsystems (3)
Kernel janitors FPGA manager framework FPGA DFL drivers
lore
Share & tools
lore

Dan Carpenter

author
#0 lore raw

PATCH 1/1 fpga: prevent integer overflow in dfl_feature_ioctl_set_irq()

The "hdr.count * sizeof(s32)" multiplication can overflow on 32 bit systems leading to memory corruption. Use array_size() to fix that.

Fixes 322b598be4d9 ("fpga: dfl: introduce interrupt trigger setting API")
Signed-off-by Dan Carpenter <[email protected]>
---
 drivers/fpga/dfl.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/fpga/dfl.c +1 -1
index 5498bc337f8b..b9aae85ba930 100644
@@ -1866,7 +1866,7 @@ long dfl_feature_ioctl_set_irq(struct platform_device *pdev,
 		return -EINVAL;
 
 	fds = memdup_user((void __user *)(arg + sizeof(hdr)),
-			  hdr.count * sizeof(s32));
+			  array_size(hdr.count, sizeof(s32)));
 	if (IS_ERR(fds))
 		return PTR_ERR(fds);
Signature · 1 line
2.35.1
maintainer Acked-by on v1 1/1 Applied
#1 lore raw
Quoted 5 lines · Dan Carpenter

The "hdr.count * sizeof(s32)" multiplication can overflow on 32 bit systems leading to memory corruption. Use array_size() to fix that.

Fixes 322b598be4d9 ("fpga: dfl: introduce interrupt trigger setting API")
Signed-off-by Dan Carpenter <[email protected]>
Acked-by Xu Yilun <[email protected]>

Applied to fpga for-next.

Thanks
Yilun

Quoted 20 lines
---
 drivers/fpga/dfl.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/fpga/dfl.c +1 -1
index 5498bc337f8b..b9aae85ba930 100644
@@ -1866,7 +1866,7 @@ long dfl_feature_ioctl_set_irq(struct platform_device *pdev,
 		return -EINVAL;
 
 	fds = memdup_user((void __user *)(arg + sizeof(hdr)),
-			  hdr.count * sizeof(s32));
+			  array_size(hdr.count, sizeof(s32)));
 	if (IS_ERR(fds))
 		return PTR_ERR(fds);
Signature · 1 line
2.35.1