Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit c263ff65 authored by Roland Dreier's avatar Roland Dreier
Browse files

IB/mthca: Avoid integer overflow when allocating huge ICM table 



In mthca_alloc_icm_table(), the number of entries to allocate for the
table->icm array is computed by calculating obj_size * nobj and then
dividing by MTHCA_TABLE_CHUNK_SIZE.  If nobj is really large, then
obj_size * nobj may overflow and the division may get the wrong value
(even a negative value).  Fix this by calculating the number of
objects per chunk and then dividing nobj by this value instead.

This patch allows crazy configurations such as loading ib_mthca with
the module parameter num_mtt=33554432 to work properly.

Signed-off-by: default avatarRoland Dreier <rolandd@cisco.com>
parent 19773539

drivers/infiniband/hw/mthca/mthca_memfree.c

+3 −1
Original line number Diff line number Diff line
@@ -359,12 +359,14 @@ struct mthca_icm_table *mthca_alloc_icm_table(struct mthca_dev *dev, 
					      int use_lowmem, int use_coherent)

{

	struct mthca_icm_table *table;

	int obj_per_chunk;

	int num_icm;

	unsigned chunk_size;

	int i;

	u8 status;



	num_icm = (obj_size * nobj + MTHCA_TABLE_CHUNK_SIZE - 1) / MTHCA_TABLE_CHUNK_SIZE;

	obj_per_chunk = MTHCA_TABLE_CHUNK_SIZE / obj_size;

	num_icm = DIV_ROUND_UP(nobj, obj_per_chunk);



	table = kmalloc(sizeof *table + num_icm * sizeof *table->icm, GFP_KERNEL);

	if (!table)