From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1755353AbcBEQi2 (ORCPT ); Fri, 5 Feb 2016 11:38:28 -0500 Received: from mga09.intel.com ([134.134.136.24]:37303 "EHLO mga09.intel.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751637AbcBEQiY (ORCPT ); Fri, 5 Feb 2016 11:38:24 -0500 X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="5.22,401,1449561600"; d="scan'208";a="877881185" From: Alexander Shishkin To: Greg KH Cc: Mathieu Poirier , Chunyan Zhang , laurent.fert@intel.com, yann.fouassier@intel.com, linux-kernel@vger.kernel.org, Alexander Shishkin Subject: [QUEUED v0 07/19] stm class: Prevent user-controllable allocations Date: Fri, 5 Feb 2016 18:35:16 +0200 Message-Id: <1454690128-21994-8-git-send-email-alexander.shishkin@linux.intel.com> X-Mailer: git-send-email 2.7.0.rc3 In-Reply-To: <1454690128-21994-1-git-send-email-alexander.shishkin@linux.intel.com> References: <1454690128-21994-1-git-send-email-alexander.shishkin@linux.intel.com> Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Currently, the character device write method allocates a temporary buffer for user's data, but the user's data size is not sanitized and can cause arbitrarily large allocations via kzalloc() or an integer overflow that will then result in overwriting kernel memory. This patch trims the input buffer size to avoid these issues. Reported-by: Sasha Levin Signed-off-by: Alexander Shishkin --- drivers/hwtracing/stm/core.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/drivers/hwtracing/stm/core.c b/drivers/hwtracing/stm/core.c index 40a8b79ab7..aef8ddb244 100644 --- a/drivers/hwtracing/stm/core.c +++ b/drivers/hwtracing/stm/core.c @@ -406,6 +406,9 @@ static ssize_t stm_char_write(struct file *file, const char __user *buf, char *kbuf; int err; + if (count + 1 > PAGE_SIZE) + count = PAGE_SIZE - 1; + /* * if no m/c have been assigned to this writer up to this * point, use "default" policy entry -- 2.7.0