Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 8c9edf63 authored by Allen Hubbe's avatar Allen Hubbe Committed by Jon Mason
Browse files

NTB: Fix zero size or integer overflow in ntb_set_mw 



A plain 32 bit integer will overflow for values over 4GiB.

Change the plain integer size to the appropriate size type in
ntb_set_mw.  Change the type of the size parameter and two local
variables used for size.

Even if there is no overflow, a size of zero is invalid here.

Reported-by: default avatarJuyoung Jung <jjung@micron.com>
Signed-off-by: default avatarAllen Hubbe <Allen.Hubbe@emc.com>
Signed-off-by: default avatarJon Mason <jdmason@kudzu.us>
parent 8b5a22d8

drivers/ntb/ntb_transport.c

+6 −3
Original line number Diff line number Diff line
@@ -629,13 +629,16 @@ static void ntb_free_mw(struct ntb_transport_ctx *nt, int num_mw) 
}



static int ntb_set_mw(struct ntb_transport_ctx *nt, int num_mw,

		      unsigned int size)

		      resource_size_t size)

{

	struct ntb_transport_mw *mw = &nt->mw_vec[num_mw];

	struct pci_dev *pdev = nt->ndev->pdev;

	unsigned int xlat_size, buff_size;

	size_t xlat_size, buff_size;

	int rc;



	if (!size)

		return -EINVAL;



	xlat_size = round_up(size, mw->xlat_align_size);

	buff_size = round_up(size, mw->xlat_align);
@@ -655,7 +658,7 @@ static int ntb_set_mw(struct ntb_transport_ctx *nt, int num_mw, 
	if (!mw->virt_addr) {

		mw->xlat_size = 0;

		mw->buff_size = 0;

		dev_err(&pdev->dev, "Unable to alloc MW buff of size %d\n",

		dev_err(&pdev->dev, "Unable to alloc MW buff of size %zu\n",

			buff_size);

		return -ENOMEM;

	}