Re: [PATCH 1/5 v4] accel/qaic: tighten bounds checking in encode_message()

[Jeffrey Hugo]

On 7/14/2023 5:41 AM, Pranjal Ramajor Asha Kanojiya wrote:
> On 7/11/2023 1:50 PM, Dan Carpenter wrote:
> > There are several issues in this code.  The check at the start of the
> > loop:
> >
> >     if (user_len >= user_msg->len) {
> >
> > This check does not ensure that we have enough space for the trans_hdr
> > (8 bytes).  Instead the check needs to be:
> >
> >     if (user_len > user_msg->len - sizeof(*trans_hdr)) {
> >
> > That subtraction is done as an unsigned long we want to avoid
> > negatives.  Add a lower bound to the start of the function.
> >
> >     if (user_msg->len < sizeof(*trans_hdr))
> >
> > There is a second integer underflow which can happen if
> > trans_hdr->len is zero inside the encode_passthrough() function.
> >
> >     memcpy(out_trans->data, in_trans->data, in_trans->hdr.len - 
> > sizeof(in_trans->hdr));
> >
> > Instead of adding a check to encode_passthrough() it's better to check
> > in this central place.  Add that check:
> >
> >     if (trans_hdr->len < sizeof(trans_hdr)
> >
> > The final concern is that the "user_len + trans_hdr->len" might have an
> > integer overflow bug.  Use size_add() to prevent that.
> >
> > -    if (user_len + trans_hdr->len > user_msg->len) {
> > +    if (size_add(user_len, trans_hdr->len) > user_msg->len) {
> >
> > Fixes: 129776ac2e38 ("accel/qaic: Add control path")
> > Signed-off-by: Dan Carpenter <dan.carpenter@xxxxxxxxxx>
>
> Reviewed-by: Pranjal Ramajor Asha Kanojiya <quic_pkanojiy@xxxxxxxxxxx>

Applied to drm-misc-fixes

-Jeff