From: Dan Carpenter <dan.carpenter@oracle.com>
Date: Fri, 4 Nov 2011 18:24:08 +0000 (+0300)
Subject: xen-gntalloc: integer overflow in gntalloc_ioctl_alloc()
X-Git-Tag: firefly_0821_release~7541^2~2279
X-Git-Url: http://demsky.eecs.uci.edu/git/?a=commitdiff_plain;h=2c59105ba0af5df97d9b614c999553f79d6ece67;p=firefly-linux-kernel-4.4.55.git

xen-gntalloc: integer overflow in gntalloc_ioctl_alloc()

commit 21643e69a4c06f7ef155fbc70e3fba13fba4a756 upstream.

On 32 bit systems a high value of op.count could lead to an integer
overflow in the kzalloc() and gref_ids would be smaller than
expected.  If the you triggered another integer overflow in
"if (gref_size + op.count > limit)" then you'd probably get memory
corruption inside add_grefs().

Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---

diff --git a/drivers/xen/gntalloc.c b/drivers/xen/gntalloc.c
index f6832f46aea4..23c60cf4313e 100644
--- a/drivers/xen/gntalloc.c
+++ b/drivers/xen/gntalloc.c
@@ -280,7 +280,7 @@ static long gntalloc_ioctl_alloc(struct gntalloc_file_private_data *priv,
 		goto out;
 	}
 
-	gref_ids = kzalloc(sizeof(gref_ids[0]) * op.count, GFP_TEMPORARY);
+	gref_ids = kcalloc(op.count, sizeof(gref_ids[0]), GFP_TEMPORARY);
 	if (!gref_ids) {
 		rc = -ENOMEM;
 		goto out;