misc: mic: fix possible signed underflow (undefined behavior) in userspace API
authorSudeep Dutt <sudeep.dutt@intel.com>
Mon, 3 Feb 2014 22:53:19 +0000 (14:53 -0800)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Fri, 7 Feb 2014 23:30:34 +0000 (15:30 -0800)
commit3b1cc9b9622a022208ec95b1259b05bbdf712eb7
treec80a0f6b893b3bb48b70b23c13f5258ba06a8d82
parent01ab1167cd2d861d20195eda08505652c536df97
misc: mic: fix possible signed underflow (undefined behavior) in userspace API

iovcnt is declared as a signed integer in both the userspace API and
as a local variable in mic_virtio.c. The while() loop in mic_virtio.c
iterates until the local variable iovcnt reaches the value 0. If
userspace passes e.g. INT_MIN as iovcnt field, this loop then appears
to depend on an undefined behavior (signed underflow) to complete.
The fix is to use unsigned integers in both the userspace API and
the local variable.

This issue was reported @ https://lkml.org/lkml/2014/1/10/10

Reported-by: Mathieu Desnoyers <mathieu.desnoyers@efficios.com>
Reviewed-by: Ashutosh Dixit <ashutosh.dixit@intel.com>
Signed-off-by: Sudeep Dutt <sudeep.dutt@intel.com>
Cc: stable <stable@vger.kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
drivers/misc/mic/host/mic_virtio.c
include/uapi/linux/mic_ioctl.h