Commit 60bb83b8 authored Apr 13, 2018 by Takashi Iwai Committed by Linus Torvalds Apr 13, 2018

resource: fix integer overflow at reallocation

We've got a bug report indicating a kernel panic at booting on an x86-32
system, and it turned out to be the invalid PCI resource assigned after
reallocation.  __find_resource() first aligns the resource start address
and resets the end address with start+size-1 accordingly, then checks
whether it's contained.  Here the end address may overflow the integer,
although resource_contains() still returns true because the function
validates only start and end address.  So this ends up with returning an
invalid resource (start > end).

There was already an attempt to cover such a problem in the commit
47ea91b4 ("Resource: fix wrong resource window calculation"), but
this case is an overseen one.

This patch adds the validity check of the newly calculated resource for
avoiding the integer overflow problem.

Bugzilla: http://bugzilla.opensuse.org/show_bug.cgi?id=1086739
Link: http://lkml.kernel.org/r/s5hpo37d5l8.wl-tiwai@suse.de


Fixes: 23c570a6 ("resource: ability to resize an allocated resource")
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Reported-by: Michael Henders <hendersm@shaw.ca>
Tested-by: Michael Henders <hendersm@shaw.ca>
Reviewed-by: Andrew Morton <akpm@linux-foundation.org>
Cc: Ram Pai <linuxram@us.ibm.com>
Cc: Bjorn Helgaas <bhelgaas@google.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

parent 16e205cf

kernel/resource.c

+2 −1

Original line number	Original line	Diff line number	Diff line
	@@ -651,7 +651,8 @@ static int __find_resource(struct resource root, struct resource old,
	alloc.start = constraint->alignf(constraint->alignf_data, &avail,		alloc.start = constraint->alignf(constraint->alignf_data, &avail,
	size, constraint->align);		size, constraint->align);
	alloc.end = alloc.start + size - 1;		alloc.end = alloc.start + size - 1;
	if (resource_contains(&avail, &alloc)) {		if (alloc.start <= alloc.end &&
			resource_contains(&avail, &alloc)) {
	new->start = alloc.start;		new->start = alloc.start;
	new->end = alloc.end;		new->end = alloc.end;
	return 0;		return 0;

Admin message