diff options
| author | Jason Wang <jasowang@redhat.com> | 2021-10-19 09:01:44 +0200 |
|---|---|---|
| committer | Michael S. Tsirkin <mst@redhat.com> | 2021-11-01 10:26:48 +0100 |
| commit | 28962ec595d701ec9d39369f9774895dfa408273 (patch) | |
| tree | f3f44b8e7d47cf40053f364f417859c5eb8c1213 /drivers/char | |
| parent | virtio_blk: Fix spelling mistake: "advertisted" -> "advertised" (diff) | |
| download | linux-28962ec595d701ec9d39369f9774895dfa408273.tar.xz linux-28962ec595d701ec9d39369f9774895dfa408273.zip | |
virtio_console: validate max_nr_ports before trying to use it
We calculate nr_ports based on the max_nr_ports:
nr_queues = use_multiport(portdev) ? (nr_ports + 1) * 2 : 2;
If the device advertises a large max_nr_ports, we will end up with a
integer overflow. Fixing this by validating the max_nr_ports and fail
the probe for invalid max_nr_ports in this case.
Cc: Amit Shah <amit@kernel.org>
Signed-off-by: Jason Wang <jasowang@redhat.com>
Link: https://lore.kernel.org/r/20211019070152.8236-3-jasowang@redhat.com
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Diffstat (limited to 'drivers/char')
| -rw-r--r-- | drivers/char/virtio_console.c | 9 |
1 files changed, 9 insertions, 0 deletions
diff --git a/drivers/char/virtio_console.c b/drivers/char/virtio_console.c index 7eaf303a7a86..660c5c388c29 100644 --- a/drivers/char/virtio_console.c +++ b/drivers/char/virtio_console.c @@ -28,6 +28,7 @@ #include "../tty/hvc/hvc_console.h" #define is_rproc_enabled IS_ENABLED(CONFIG_REMOTEPROC) +#define VIRTCONS_MAX_PORTS 0x8000 /* * This is a global struct for storing common data for all the devices @@ -2036,6 +2037,14 @@ static int virtcons_probe(struct virtio_device *vdev) virtio_cread_feature(vdev, VIRTIO_CONSOLE_F_MULTIPORT, struct virtio_console_config, max_nr_ports, &portdev->max_nr_ports) == 0) { + if (portdev->max_nr_ports == 0 || + portdev->max_nr_ports > VIRTCONS_MAX_PORTS) { + dev_err(&vdev->dev, + "Invalidate max_nr_ports %d", + portdev->max_nr_ports); + err = -EINVAL; + goto free; + } multiport = true; } |