VMCI: Fix integer overflow in VMCI handle arrays

[mirror_ubuntu-bionic-kernel.git] / drivers / misc / vmw_vmci / vmci_handle_array.c

diff --git a/drivers/misc/vmw_vmci/vmci_handle_array.c b/drivers/misc/vmw_vmci/vmci_handle_array.c
index 344973a0fb0acaac1185b065d16d6e9144600d71..917e18a8af9523231095a82e7d647ab3c32ba73f 100644 (file)
--- a/drivers/misc/vmw_vmci/vmci_handle_array.c
+++ b/drivers/misc/vmw_vmci/vmci_handle_array.c
@@ -16,24 +16,29 @@
 #include <linux/slab.h>
 #include "vmci_handle_array.h"
 
-static size_t handle_arr_calc_size(size_t capacity)
+static size_t handle_arr_calc_size(u32 capacity)
 {
-       return sizeof(struct vmci_handle_arr) +
+       return VMCI_HANDLE_ARRAY_HEADER_SIZE +
            capacity * sizeof(struct vmci_handle);
 }
 
-struct vmci_handle_arr *vmci_handle_arr_create(size_t capacity)
+struct vmci_handle_arr *vmci_handle_arr_create(u32 capacity, u32 max_capacity)
 {
        struct vmci_handle_arr *array;
 
+       if (max_capacity == 0 || capacity > max_capacity)
+               return NULL;
+
        if (capacity == 0)
-               capacity = VMCI_HANDLE_ARRAY_DEFAULT_SIZE;
+               capacity = min((u32)VMCI_HANDLE_ARRAY_DEFAULT_CAPACITY,
+                              max_capacity);
 
        array = kmalloc(handle_arr_calc_size(capacity), GFP_ATOMIC);
        if (!array)
                return NULL;
 
        array->capacity = capacity;
+       array->max_capacity = max_capacity;
        array->size = 0;
 
        return array;
@@ -44,27 +49,34 @@ void vmci_handle_arr_destroy(struct vmci_handle_arr *array)
        kfree(array);
 }
 
-void vmci_handle_arr_append_entry(struct vmci_handle_arr **array_ptr,
-                                 struct vmci_handle handle)
+int vmci_handle_arr_append_entry(struct vmci_handle_arr **array_ptr,
+                                struct vmci_handle handle)
 {
        struct vmci_handle_arr *array = *array_ptr;
 
        if (unlikely(array->size >= array->capacity)) {
                /* reallocate. */
                struct vmci_handle_arr *new_array;
-               size_t new_capacity = array->capacity * VMCI_ARR_CAP_MULT;
-               size_t new_size = handle_arr_calc_size(new_capacity);
+               u32 capacity_bump = min(array->max_capacity - array->capacity,
+                                       array->capacity);
+               size_t new_size = handle_arr_calc_size(array->capacity +
+                                                      capacity_bump);
+
+               if (array->size >= array->max_capacity)
+                       return VMCI_ERROR_NO_MEM;
 
                new_array = krealloc(array, new_size, GFP_ATOMIC);
                if (!new_array)
-                       return;
+                       return VMCI_ERROR_NO_MEM;
 
-               new_array->capacity = new_capacity;
+               new_array->capacity += capacity_bump;
                *array_ptr = array = new_array;
        }
 
        array->entries[array->size] = handle;
        array->size++;
+
+       return VMCI_SUCCESS;
 }
 
 /*
@@ -74,7 +86,7 @@ struct vmci_handle vmci_handle_arr_remove_entry(struct vmci_handle_arr *array,
                                                struct vmci_handle entry_handle)
 {
        struct vmci_handle handle = VMCI_INVALID_HANDLE;
-       size_t i;
+       u32 i;
 
        for (i = 0; i < array->size; i++) {
                if (vmci_handle_is_equal(array->entries[i], entry_handle)) {
@@ -109,7 +121,7 @@ struct vmci_handle vmci_handle_arr_remove_tail(struct vmci_handle_arr *array)
  * Handle at given index, VMCI_INVALID_HANDLE if invalid index.
  */
 struct vmci_handle
-vmci_handle_arr_get_entry(const struct vmci_handle_arr *array, size_t index)
+vmci_handle_arr_get_entry(const struct vmci_handle_arr *array, u32 index)
 {
        if (unlikely(index >= array->size))
                return VMCI_INVALID_HANDLE;
@@ -120,7 +132,7 @@ vmci_handle_arr_get_entry(const struct vmci_handle_arr *array, size_t index)
 bool vmci_handle_arr_has_entry(const struct vmci_handle_arr *array,
                               struct vmci_handle entry_handle)
 {
-       size_t i;
+       u32 i;
 
        for (i = 0; i < array->size; i++)
                if (vmci_handle_is_equal(array->entries[i], entry_handle))