VMCI: integer overflow in vmci_datagram_dispatch()

Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git

kernel os linux

This is untrusted user data from vmci_host_do_send_datagram() so the
VMCI_DG_SIZE() macro can have an integer overflow.

Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

authored by

Dan Carpenter and committed by

Greg Kroah-Hartman 11 years ago 2e453546 95e838c9

+2 -1

1 changed file

expand all

drivers

misc

vmw_vmci

vmci_datagram.c

+2 -1

drivers/misc/vmw_vmci/vmci_datagram.c

··· 328 328 329 329 BUILD_BUG_ON(sizeof(struct vmci_datagram) != 24); 330 330 331 - if (VMCI_DG_SIZE(dg) > VMCI_MAX_DG_SIZE) { 331 + if (dg->payload_size > VMCI_MAX_DG_SIZE || 332 + VMCI_DG_SIZE(dg) > VMCI_MAX_DG_SIZE) { 332 333 pr_devel("Payload (size=%llu bytes) too big to send\n", 333 334 (unsigned long long)dg->payload_size); 334 335 return VMCI_ERROR_INVALID_ARGS;