RHEL-183408 viostor: fix overflow in bump allocator bounds checks

Signed-off-by: rachael-george <rgeorge@redhat.com>

Author: rachael-george

viostor/virtio_pci.c

@@ -122,20 +122,23 @@ static void WriteVirtIODeviceWord(ULONG_PTR ulRegister, u16 wValue)
 static void *mem_alloc_contiguous_pages(void *context, size_t size)
 {
     PADAPTER_EXTENSION adaptExt = (PADAPTER_EXTENSION)context;
-    PVOID ptr = (PVOID)((ULONG_PTR)adaptExt->pageAllocationVa + adaptExt->pageOffset);
+    SIZE_T pageOffset = adaptExt->pageOffset;
+    SIZE_T pageSize = adaptExt->pageAllocationSize;
+    SIZE_T alignedSize;
+    PVOID ptr;
 
-    if ((adaptExt->pageOffset + size) <= adaptExt->pageAllocationSize)
-    {
-        size = ROUND_TO_PAGES(size);
-        adaptExt->pageOffset += size;
-        RtlZeroMemory(ptr, size);
-        return ptr;
-    }
-    else
+    alignedSize = ROUND_TO_PAGES(size);
+
+    if (alignedSize < size || alignedSize > pageSize || pageOffset > pageSize - alignedSize)
     {
         RhelDbgPrint(TRACE_LEVEL_FATAL, " Ran out of memory in (%Id)\n", size);
         return NULL;
     }
+
+    ptr = (PVOID)((ULONG_PTR)adaptExt->pageAllocationVa + pageOffset);
+    adaptExt->pageOffset = (ULONG)(pageOffset + alignedSize);
+    RtlZeroMemory(ptr, alignedSize);
+    return ptr;
 }
 
 static void mem_free_contiguous_pages(void *context, void *virt)

viostor/virtio_stor.c

@@ -2464,17 +2464,23 @@ PVOID
 VioStorPoolAlloc(IN PVOID DeviceExtension, IN SIZE_T size)
 {
     PADAPTER_EXTENSION adaptExt = (PADAPTER_EXTENSION)DeviceExtension;
-    PVOID ptr = (PVOID)((ULONG_PTR)adaptExt->poolAllocationVa + adaptExt->poolOffset);
+    SIZE_T poolOffset = adaptExt->poolOffset;
+    SIZE_T poolSize = adaptExt->poolAllocationSize;
+    SIZE_T alignedSize;
+    PVOID ptr;
 
-    if ((adaptExt->poolOffset + size) <= adaptExt->poolAllocationSize)
+    alignedSize = ROUND_TO_CACHE_LINES(size);
+
+    if (alignedSize < size || alignedSize > poolSize || poolOffset > poolSize - alignedSize)
     {
-        size = ROUND_TO_CACHE_LINES(size);
-        adaptExt->poolOffset += (ULONG)size;
-        RtlZeroMemory(ptr, size);
-        return ptr;
+        RhelDbgPrint(TRACE_LEVEL_FATAL, "Ran out of memory in VioStorPoolAlloc(%Id)\n", size);
+        return NULL;
     }
-    RhelDbgPrint(TRACE_LEVEL_FATAL, "Ran out of memory in VioStorPoolAlloc(%Id)\n", size);
-    return NULL;
+
+    ptr = (PVOID)((ULONG_PTR)adaptExt->poolAllocationVa + poolOffset);
+    adaptExt->poolOffset = (ULONG)(poolOffset + alignedSize);
+    RtlZeroMemory(ptr, alignedSize);
+    return ptr;
 }
 
 UCHAR FirmwareRequest(IN PVOID DeviceExtension, IN PSRB_TYPE Srb)