RDMA/amso1100: integer overflow in c2_alloc_cq_buf()

PATCH New Dan Carpenter 1 participant 1 message Jul 17, 2014

Subsystems (2)

Kernel janitors InfiniBand

lore

Share & tools

lore

Dan Carpenter

author

2014-07-17 07:44 UTC #0 lore raw

PATCH 1/1 RDMA/amso1100: integer overflow in c2_alloc_cq_buf()

This is a static checker fix. The static checker says that q_size comes from the user and can be any 32 bit value. The call tree is:
--> ib_uverbs_create_cq()

      --> c2_create_cq()
          --> c2_init_cq()

Signed-off-by Dan Carpenter <[email protected]>

drivers/infiniband/hw/amso1100/c2_cq.c +5 -2

index 49e0e85..1b63185 100644
@@ -260,11 +260,14 @@ static void c2_free_cq_buf(struct c2_dev *c2dev, struct c2_mq *mq)
 			  mq->msg_pool.host, dma_unmap_addr(mq, mapping));
 }
 
-static int c2_alloc_cq_buf(struct c2_dev *c2dev, struct c2_mq *mq, int q_size,
-			   int msg_size)
+static int c2_alloc_cq_buf(struct c2_dev *c2dev, struct c2_mq *mq,
+			   size_t q_size, size_t msg_size)
 {
 	u8 *pool_start;
 
+	if (q_size > SIZE_MAX / msg_size)
+		return -EINVAL;
+
 	pool_start = dma_alloc_coherent(&c2dev->pcidev->dev, q_size * msg_size,
 					&mq->host_dma, GFP_KERNEL);
 	if (!pool_start)