On Wednesday 18 October 2017 12:28 AM, Bjorn Helgaas wrote:
> On Sat, Sep 30, 2017 at 11:15:52AM +0300, Dan Carpenter wrote:
>> "size + max" can have an arithmetic overflow when we're allocating:
>>
>> orig_src_addr = dma_alloc_coherent(dev, size + alignment, ...
>>
>> I've added a few checks to prevent that.
>>
>> Fixes: 13107c60681f ("misc: pci_endpoint_test: Add support to provide aligned buffer addresses")
>> Signed-off-by: Dan Carpenter <dan.carpenter@xxxxxxxxxx>
>
> Both applied to pci/endpoint for v4.15, thanks!
>
> Kishon, if you want to ack/nack this, I'll act accordingly.
patch looks correct
Acked-by: Kishon Vijay Abraham I <kishon@xxxxxx>
>
>> diff --git a/drivers/misc/pci_endpoint_test.c b/drivers/misc/pci_endpoint_test.c
>> index deb203026496..c0d323077ad0 100644
>> --- a/drivers/misc/pci_endpoint_test.c
>> +++ b/drivers/misc/pci_endpoint_test.c
>> @@ -226,6 +226,9 @@ static bool pci_endpoint_test_copy(struct pci_endpoint_test *test, size_t size)
>> u32 src_crc32;
>> u32 dst_crc32;
>>
>> + if (size > SIZE_MAX - alignment)
>> + goto err;
>> +
>> orig_src_addr = dma_alloc_coherent(dev, size + alignment,
>> &orig_src_phys_addr, GFP_KERNEL);
>> if (!orig_src_addr) {
>> @@ -311,6 +314,9 @@ static bool pci_endpoint_test_write(struct pci_endpoint_test *test, size_t size)
>> size_t alignment = test->alignment;
>> u32 crc32;
>>
>> + if (size > SIZE_MAX - alignment)
>> + goto err;
>> +
>> orig_addr = dma_alloc_coherent(dev, size + alignment, &orig_phys_addr,
>> GFP_KERNEL);
>> if (!orig_addr) {
>> @@ -369,6 +375,9 @@ static bool pci_endpoint_test_read(struct pci_endpoint_test *test, size_t size)
>> size_t alignment = test->alignment;
>> u32 crc32;
>>
>> + if (size > SIZE_MAX - alignment)
>> + goto err;
>> +
>> orig_addr = dma_alloc_coherent(dev, size + alignment, &orig_phys_addr,
>> GFP_KERNEL);
>> if (!orig_addr) {
