AuxXxilium/linux_dsm_epyc7002
1
0
Fork 0
mirror of https://github.com/AuxXxilium/linux_dsm_epyc7002.git synced 2025-04-16 06:47:46 +07:00
Code Issues Actions Packages Projects Releases Wiki Activity

NTB: Fix zero size or integer overflow in ntb_set_mw

Browse Source 
A plain 32 bit integer will overflow for values over 4GiB.

Change the plain integer size to the appropriate size type in
ntb_set_mw.  Change the type of the size parameter and two local
variables used for size.

Even if there is no overflow, a size of zero is invalid here.

Reported-by: Juyoung Jung <jjung@micron.com>
Signed-off-by: Allen Hubbe <Allen.Hubbe@emc.com>
Signed-off-by: Jon Mason <jdmason@kudzu.us>
This commit is contained in:
Allen Hubbe 2015-07-13 08:07:13 -04:00 committed by Jon Mason
parent 8b5a22d8f1
commit 8c9edf63e7
1 changed files with 6 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
drivers/ntb/ntb_transport.c
View File

@ -629,13 +629,16 @@ static void ntb_free_mw(struct ntb_transport_ctx *nt, int num_mw)
} }
static int ntb_set_mw(struct ntb_transport_ctx *nt, int num_mw, static int ntb_set_mw(struct ntb_transport_ctx *nt, int num_mw,
unsigned int size) resource_size_t size)
{ {
struct ntb_transport_mw *mw = &nt->mw_vec[num_mw]; struct ntb_transport_mw *mw = &nt->mw_vec[num_mw];
struct pci_dev *pdev = nt->ndev->pdev; struct pci_dev *pdev = nt->ndev->pdev;
unsigned int xlat_size, buff_size; size_t xlat_size, buff_size;
int rc; int rc;
if (!size)
return -EINVAL;
xlat_size = round_up(size, mw->xlat_align_size); xlat_size = round_up(size, mw->xlat_align_size);
buff_size = round_up(size, mw->xlat_align); buff_size = round_up(size, mw->xlat_align);
@ -655,7 +658,7 @@ static int ntb_set_mw(struct ntb_transport_ctx *nt, int num_mw,
if (!mw->virt_addr) { if (!mw->virt_addr) {
mw->xlat_size = 0; mw->xlat_size = 0;
mw->buff_size = 0; mw->buff_size = 0;
dev_err(&pdev->dev, "Unable to alloc MW buff of size %d\n", dev_err(&pdev->dev, "Unable to alloc MW buff of size %zu\n",
buff_size); buff_size);
return -ENOMEM; return -ENOMEM;
} }