Re: [PATCH v2 1/6] PCI: Prevent overflow in proc_bus_pci_{read,write}()
| Newsgroups | org.kernel.vger.linux-pci |
|---|---|
| Message-ID | <[email protected]> |
> proc_bus_pci_read() and proc_bus_pci_write() receive the file position
> as a 64-bit loff_t, but store it in 32-bit variables before validating
> the configuration-space bounds.
>
> In proc_bus_pci_read(), pos is an unsigned int, so an offset such as
> 0x100000000 is truncated to zero. The truncated value passes the bounds
> check and causes the function to read from the beginning of PCI
> configuration space instead of returning EOF.
>
> In proc_bus_pci_write(), pos is an int, so an offset greater than
> INT_MAX may become negative. The negative value bypasses the
> pos >= size check and is then mixed with the unsigned nbytes value.
> The bounds adjustment may consequently expand a small request into a
> very large transfer, causing the write loop to use invalid negative
> configuration offsets and run for an excessive amount of time.
>
> Fix this by changing the type of pos to loff_t.
>
> Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
> Suggested-by: Ilpo Järvinen <[email protected]>
> Signed-off-by: Yongqiang Liu <[email protected]>
> Signed-off-by: Ziming Du <[email protected]>
Sashiko has reviewed this patch and found no issues. It looks great!
--
Sashiko AI review · https://sashiko.dev/#/patchset/[email protected]?part=1