LKML Archive on
help / color / mirror / Atom feed
* [PATCH] resource: Fix integer overflow at reallocation
@ 2018-04-02  7:16 Takashi Iwai
  2018-04-02 19:09 ` Ram Pai
  2018-04-05  1:34 ` Sasha Levin
  0 siblings, 2 replies; 6+ messages in thread
From: Takashi Iwai @ 2018-04-02  7:16 UTC (permalink / raw)
  To: Bjorn Helgaas; +Cc: linux-kernel, Michael Henders, Ram Pai

We've got a bug report indicating a kernel panic at booting on an
x86-32 system, and it turned out to be the invalid resource assigned
after reallocation.  __find_resource() first aligns the resource start
address and resets the end address with start+size-1 accordingly, then
checks whether it's contained.  Here the end address may overflow the
integer, although resource_contains() still returns true because the
function validates only start and end address.  So this ends up with
returning an invalid resource (start > end).

There was already an attempt to cover such a problem in the commit
47ea91b4052d ("Resource: fix wrong resource window calculation"), but
this case is an overseen one.

This patch adds the validity check of the newly calculated resource
for avoiding the integer overflow problem.

Fixes: 23c570a67448 ("resource: ability to resize an allocated resource")
Reported-and-tested-by: Michael Henders <>
Cc: <>
Signed-off-by: Takashi Iwai <>

Bjorn, I send this to you since the bug hits during PCI init, although
the culprit is in generic resource management.

 kernel/resource.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/kernel/resource.c b/kernel/resource.c
index e270b5048988..2af6c03858b9 100644
--- a/kernel/resource.c
+++ b/kernel/resource.c
@@ -651,7 +651,8 @@ static int __find_resource(struct resource *root, struct resource *old,
 			alloc.start = constraint->alignf(constraint->alignf_data, &avail,
 					size, constraint->align);
 			alloc.end = alloc.start + size - 1;
-			if (resource_contains(&avail, &alloc)) {
+			if (alloc.start <= alloc.end &&
+			    resource_contains(&avail, &alloc)) {
 				new->start = alloc.start;
 				new->end = alloc.end;
 				return 0;

^ permalink raw reply related	[flat|nested] 6+ messages in thread

end of thread, other threads:[~2018-04-06  0:23 UTC | newest]

Thread overview: 6+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2018-04-02  7:16 [PATCH] resource: Fix integer overflow at reallocation Takashi Iwai
2018-04-02 19:09 ` Ram Pai
2018-04-02 20:35   ` Takashi Iwai
2018-04-05 14:40     ` Takashi Iwai
2018-04-06  0:23       ` Ram Pai
2018-04-05  1:34 ` Sasha Levin

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).