From: Jan Beulich Date: Thu, 5 Mar 2020 10:34:30 +0000 (+0100) Subject: xmalloc: guard against integer overflow X-Git-Tag: archive/raspbian/4.11.4-1+rpi1^2~58^2~21 X-Git-Url: https://dgit.raspbian.org/?a=commitdiff_plain;h=2ffed5c92feb23babf06a5754e7800bfea99e26b;p=xen.git xmalloc: guard against integer overflow There are hypercall handling paths (EFI ones are what this was found with) needing to allocate buffers of a caller specified size. This is generally fine, as our page allocator enforces an upper bound on all allocations. However, certain extremely large sizes could, when adding in allocator overhead, result in an apparently tiny allocation size, which would typically result in either a successful allocation, but a severe buffer overrun when using that memory block, or in a crash right in the allocator code. Reported-by: Ilja Van Sprundel Signed-off-by: Jan Beulich Reviewed-by: George Dunlap master commit: cf38b4926e2b55d1d7715cff5095a7444f5ed42d master date: 2020-02-06 09:53:12 +0100 --- diff --git a/xen/common/xmalloc_tlsf.c b/xen/common/xmalloc_tlsf.c index b256dc56cf..987e377cbb 100644 --- a/xen/common/xmalloc_tlsf.c +++ b/xen/common/xmalloc_tlsf.c @@ -388,7 +388,17 @@ void *xmem_pool_alloc(unsigned long size, struct xmem_pool *pool) pool->init_region = region; } - size = (size < MIN_BLOCK_SIZE) ? MIN_BLOCK_SIZE : ROUNDUP_SIZE(size); + if ( size < MIN_BLOCK_SIZE ) + size = MIN_BLOCK_SIZE; + else + { + tmp_size = ROUNDUP_SIZE(size); + /* Guard against overflow. */ + if ( tmp_size < size ) + return NULL; + size = tmp_size; + } + /* Rounding up the requested size and calculating fl and sl */ spin_lock(&pool->lock); @@ -583,6 +593,10 @@ void *_xmalloc(unsigned long size, unsigned long align) align = MEM_ALIGN; size += align - MEM_ALIGN; + /* Guard against overflow. */ + if ( size < align - MEM_ALIGN ) + return NULL; + if ( !xenpool ) tlsf_init();