Skip to content

Commit

Permalink
misc: pci_endpoint_test: Prevent some integer overflows
Browse files Browse the repository at this point in the history
"size + max" can have an arithmetic overflow when we're allocating:

  orig_src_addr = dma_alloc_coherent(dev, size + alignment, ...

Add a few checks to prevent that.

Fixes: 13107c6 ("misc: pci_endpoint_test: Add support to provide aligned buffer addresses")
Signed-off-by: Dan Carpenter <[email protected]>
Signed-off-by: Bjorn Helgaas <[email protected]>
Acked-by: Kishon Vijay Abraham I <[email protected]>
  • Loading branch information
Dan Carpenter authored and bjorn-helgaas committed Oct 17, 2017
1 parent 9e66317 commit 343dc69
Showing 1 changed file with 9 additions and 0 deletions.
9 changes: 9 additions & 0 deletions drivers/misc/pci_endpoint_test.c
Original file line number Diff line number Diff line change
Expand Up @@ -226,6 +226,9 @@ static bool pci_endpoint_test_copy(struct pci_endpoint_test *test, size_t size)
u32 src_crc32;
u32 dst_crc32;

if (size > SIZE_MAX - alignment)
goto err;

orig_src_addr = dma_alloc_coherent(dev, size + alignment,
&orig_src_phys_addr, GFP_KERNEL);
if (!orig_src_addr) {
Expand Down Expand Up @@ -311,6 +314,9 @@ static bool pci_endpoint_test_write(struct pci_endpoint_test *test, size_t size)
size_t alignment = test->alignment;
u32 crc32;

if (size > SIZE_MAX - alignment)
goto err;

orig_addr = dma_alloc_coherent(dev, size + alignment, &orig_phys_addr,
GFP_KERNEL);
if (!orig_addr) {
Expand Down Expand Up @@ -369,6 +375,9 @@ static bool pci_endpoint_test_read(struct pci_endpoint_test *test, size_t size)
size_t alignment = test->alignment;
u32 crc32;

if (size > SIZE_MAX - alignment)
goto err;

orig_addr = dma_alloc_coherent(dev, size + alignment, &orig_phys_addr,
GFP_KERNEL);
if (!orig_addr) {
Expand Down

0 comments on commit 343dc69

Please sign in to comment.