Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 7b64dbf8 authored by Dan Carpenter's avatar Dan Carpenter Committed by Greg Kroah-Hartman
Browse files

misc: mic/scif: fix wrap around tests 



Signed integer overflow is undefined.  Also I added a check for
"(offset < 0)" in scif_unregister() because that makes it match the
other conditions and because I didn't want to subtract a negative.

Fixes: ba612aa8 ('misc: mic: SCIF memory registration and unregistration')
Signed-off-by: default avatarDan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent 269ad6e0

drivers/misc/mic/scif/scif_rma.c

+4 −3
Original line number Diff line number Diff line
@@ -1511,7 +1511,7 @@ off_t scif_register_pinned_pages(scif_epd_t epd, 
	if ((map_flags & SCIF_MAP_FIXED) &&

	    ((ALIGN(offset, PAGE_SIZE) != offset) ||

	    (offset < 0) ||

	    (offset + (off_t)len < offset)))

	    (len > LONG_MAX - offset)))

		return -EINVAL;



	might_sleep();
@@ -1614,7 +1614,7 @@ off_t scif_register(scif_epd_t epd, void *addr, size_t len, off_t offset, 
	if ((map_flags & SCIF_MAP_FIXED) &&

	    ((ALIGN(offset, PAGE_SIZE) != offset) ||

	    (offset < 0) ||

	    (offset + (off_t)len < offset)))

	    (len > LONG_MAX - offset)))

		return -EINVAL;



	/* Unsupported protection requested */
@@ -1732,7 +1732,8 @@ scif_unregister(scif_epd_t epd, off_t offset, size_t len) 


	/* Offset is not page aligned or offset+len wraps around */

	if ((ALIGN(offset, PAGE_SIZE) != offset) ||

	    (offset + (off_t)len < offset))

	    (offset < 0) ||

	    (len > LONG_MAX - offset))

		return -EINVAL;



	err = scif_verify_epd(ep);