The udmabuf list length limit was made configurable, creating the possibility for integer overflow that was not properly detected. If the system administrator set the udmabuf.list_limit tunable to a large value like INT_MAX, that would allow udmabuf users to submit a list whose length would overflow the u32 length variable.
Use memdup_array_user() instead of raw memdup_user() to make the length calculation an overflow-checked multiplication. Cc: [email protected] Fixes: 2e717a55982a ("udmabuf: configurable list_limit and size_limit_mb") Suggested-by: Christian König <[email protected]> Signed-off-by: Val Packett <[email protected]> --- drivers/dma-buf/udmabuf.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) diff --git a/drivers/dma-buf/udmabuf.c b/drivers/dma-buf/udmabuf.c index df6dd0046242..654ebe7f6b3f 100644 --- a/drivers/dma-buf/udmabuf.c +++ b/drivers/dma-buf/udmabuf.c @@ -470,14 +470,13 @@ static long udmabuf_ioctl_create_list(struct file *filp, unsigned long arg) struct udmabuf_create_list head; struct udmabuf_create_item *list; int ret = -EINVAL; - u32 lsize; if (copy_from_user(&head, (void __user *)arg, sizeof(head))) return -EFAULT; if (head.count > list_limit) return -EINVAL; - lsize = sizeof(struct udmabuf_create_item) * head.count; - list = memdup_user((void __user *)(arg + sizeof(head)), lsize); + list = memdup_array_user((void __user *)(arg + sizeof(head)), + head.count, sizeof(struct udmabuf_create_item)); if (IS_ERR(list)) return PTR_ERR(list); -- 2.55.0
