Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 378f79ca authored by Dan Carpenter's avatar Dan Carpenter Committed by Greg Kroah-Hartman
Browse files

misc: pci_endpoint_test: Prevent some integer overflows 



"size + max" can have an arithmetic overflow when we're allocating:

	orig_src_addr = dma_alloc_coherent(dev, size + alignment, ...

I've added a few checks to prevent that.

Fixes: 13107c60 ("misc: pci_endpoint_test: Add support to provide aligned buffer addresses")
Signed-off-by: default avatarDan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent a120fbdd

drivers/misc/pci_endpoint_test.c

+9 −0
Original line number Diff line number Diff line
@@ -226,6 +226,9 @@ static bool pci_endpoint_test_copy(struct pci_endpoint_test *test, size_t size) 
	u32 src_crc32;

	u32 dst_crc32;



	if (size > SIZE_MAX - alignment)

		goto err;



	orig_src_addr = dma_alloc_coherent(dev, size + alignment,

					   &orig_src_phys_addr, GFP_KERNEL);

	if (!orig_src_addr) {
@@ -311,6 +314,9 @@ static bool pci_endpoint_test_write(struct pci_endpoint_test *test, size_t size) 
	size_t alignment = test->alignment;

	u32 crc32;



	if (size > SIZE_MAX - alignment)

		goto err;



	orig_addr = dma_alloc_coherent(dev, size + alignment, &orig_phys_addr,

				       GFP_KERNEL);

	if (!orig_addr) {
@@ -369,6 +375,9 @@ static bool pci_endpoint_test_read(struct pci_endpoint_test *test, size_t size) 
	size_t alignment = test->alignment;

	u32 crc32;



	if (size > SIZE_MAX - alignment)

		goto err;



	orig_addr = dma_alloc_coherent(dev, size + alignment, &orig_phys_addr,

				       GFP_KERNEL);

	if (!orig_addr) {