LKML Archive on
help / color / mirror / Atom feed
From: Takashi Iwai <>
To: Bjorn Helgaas <>
Cc:, Michael Henders <>,
	Ram Pai <>
Subject: [PATCH] resource: Fix integer overflow at reallocation
Date: Mon,  2 Apr 2018 09:16:16 +0200	[thread overview]
Message-ID: <> (raw)

We've got a bug report indicating a kernel panic at booting on an
x86-32 system, and it turned out to be the invalid resource assigned
after reallocation.  __find_resource() first aligns the resource start
address and resets the end address with start+size-1 accordingly, then
checks whether it's contained.  Here the end address may overflow the
integer, although resource_contains() still returns true because the
function validates only start and end address.  So this ends up with
returning an invalid resource (start > end).

There was already an attempt to cover such a problem in the commit
47ea91b4052d ("Resource: fix wrong resource window calculation"), but
this case is an overseen one.

This patch adds the validity check of the newly calculated resource
for avoiding the integer overflow problem.

Fixes: 23c570a67448 ("resource: ability to resize an allocated resource")
Reported-and-tested-by: Michael Henders <>
Cc: <>
Signed-off-by: Takashi Iwai <>

Bjorn, I send this to you since the bug hits during PCI init, although
the culprit is in generic resource management.

 kernel/resource.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/kernel/resource.c b/kernel/resource.c
index e270b5048988..2af6c03858b9 100644
--- a/kernel/resource.c
+++ b/kernel/resource.c
@@ -651,7 +651,8 @@ static int __find_resource(struct resource *root, struct resource *old,
 			alloc.start = constraint->alignf(constraint->alignf_data, &avail,
 					size, constraint->align);
 			alloc.end = alloc.start + size - 1;
-			if (resource_contains(&avail, &alloc)) {
+			if (alloc.start <= alloc.end &&
+			    resource_contains(&avail, &alloc)) {
 				new->start = alloc.start;
 				new->end = alloc.end;
 				return 0;

             reply	other threads:[~2018-04-02  7:16 UTC|newest]

Thread overview: 6+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2018-04-02  7:16 Takashi Iwai [this message]
2018-04-02 19:09 ` Ram Pai
2018-04-02 20:35   ` Takashi Iwai
2018-04-05 14:40     ` Takashi Iwai
2018-04-06  0:23       ` Ram Pai
2018-04-05  1:34 ` Sasha Levin

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \ \ \ \ \ \ \
    --subject='Re: [PATCH] resource: Fix integer overflow at reallocation' \

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).