Commit 343dc693 authored by Dan Carpenter's avatar Dan Carpenter Committed by Bjorn Helgaas

misc: pci_endpoint_test: Prevent some integer overflows

"size + max" can have an arithmetic overflow when we're allocating:

  orig_src_addr = dma_alloc_coherent(dev, size + alignment, ...

Add a few checks to prevent that.

Fixes: 13107c60 ("misc: pci_endpoint_test: Add support to provide aligned buffer addresses")
Signed-off-by: default avatarDan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: default avatarBjorn Helgaas <bhelgaas@google.com>
Acked-by: default avatarKishon Vijay Abraham I <kishon@ti.com>
parent 9e66317d
...@@ -226,6 +226,9 @@ static bool pci_endpoint_test_copy(struct pci_endpoint_test *test, size_t size) ...@@ -226,6 +226,9 @@ static bool pci_endpoint_test_copy(struct pci_endpoint_test *test, size_t size)
u32 src_crc32; u32 src_crc32;
u32 dst_crc32; u32 dst_crc32;
if (size > SIZE_MAX - alignment)
goto err;
orig_src_addr = dma_alloc_coherent(dev, size + alignment, orig_src_addr = dma_alloc_coherent(dev, size + alignment,
&orig_src_phys_addr, GFP_KERNEL); &orig_src_phys_addr, GFP_KERNEL);
if (!orig_src_addr) { if (!orig_src_addr) {
...@@ -311,6 +314,9 @@ static bool pci_endpoint_test_write(struct pci_endpoint_test *test, size_t size) ...@@ -311,6 +314,9 @@ static bool pci_endpoint_test_write(struct pci_endpoint_test *test, size_t size)
size_t alignment = test->alignment; size_t alignment = test->alignment;
u32 crc32; u32 crc32;
if (size > SIZE_MAX - alignment)
goto err;
orig_addr = dma_alloc_coherent(dev, size + alignment, &orig_phys_addr, orig_addr = dma_alloc_coherent(dev, size + alignment, &orig_phys_addr,
GFP_KERNEL); GFP_KERNEL);
if (!orig_addr) { if (!orig_addr) {
...@@ -369,6 +375,9 @@ static bool pci_endpoint_test_read(struct pci_endpoint_test *test, size_t size) ...@@ -369,6 +375,9 @@ static bool pci_endpoint_test_read(struct pci_endpoint_test *test, size_t size)
size_t alignment = test->alignment; size_t alignment = test->alignment;
u32 crc32; u32 crc32;
if (size > SIZE_MAX - alignment)
goto err;
orig_addr = dma_alloc_coherent(dev, size + alignment, &orig_phys_addr, orig_addr = dma_alloc_coherent(dev, size + alignment, &orig_phys_addr,
GFP_KERNEL); GFP_KERNEL);
if (!orig_addr) { if (!orig_addr) {
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment