diff options
| author | Shiraz Saleem <shiraz.saleem@intel.com> | 2021-06-22 20:52:31 +0300 |
|---|---|---|
| committer | Jason Gunthorpe <jgg@nvidia.com> | 2021-06-22 21:25:47 +0300 |
| commit | c4eb44ffd9d7d30902345accb2bd1e2334d1f5f2 (patch) | |
| tree | bbee4c6e9643451278888ca90adf0204afaba1b6 /drivers/infiniband | |
| parent | f176199dc7a8a35cfd2bc76f57604614d6fafecc (diff) | |
| download | linux-c4eb44ffd9d7d30902345accb2bd1e2334d1f5f2.tar.xz | |
RDMA/irdma: Check return value from ib_umem_find_best_pgsz
iwmr->page_size stores the return from ib_umem_find_best_pgsz and maybe
zero when used in ib_umem_num_dma_blocks thus causing a divide by zero
error.
Fix this by erroring out of irdma_reg_user when 0 is returned from
ib_umem_find_best_pgsz.
Link: https://lore.kernel.org/r/20210622175232.439-3-tatyana.e.nikolova@intel.com
Reported-by: coverity-bot <keescook+coverity-bot@chromium.org>
Addresses-Coverity-ID: 1505149 ("Integer handling issues")
Fixes: b48c24c2d710 ("RDMA/irdma: Implement device supported verb APIs")
Signed-off-by: Shiraz Saleem <shiraz.saleem@intel.com>
Signed-off-by: Tatyana Nikolova <tatyana.e.nikolova@intel.com>
Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
Diffstat (limited to 'drivers/infiniband')
| -rw-r--r-- | drivers/infiniband/hw/irdma/verbs.c | 8 |
1 files changed, 7 insertions, 1 deletions
diff --git a/drivers/infiniband/hw/irdma/verbs.c b/drivers/infiniband/hw/irdma/verbs.c index e8b170f0d997..1e48077f0af4 100644 --- a/drivers/infiniband/hw/irdma/verbs.c +++ b/drivers/infiniband/hw/irdma/verbs.c @@ -2783,10 +2783,16 @@ static struct ib_mr *irdma_reg_user_mr(struct ib_pd *pd, u64 start, u64 len, iwmr->ibmr.iova = virt; iwmr->page_size = PAGE_SIZE; - if (req.reg_type == IRDMA_MEMREG_TYPE_MEM) + if (req.reg_type == IRDMA_MEMREG_TYPE_MEM) { iwmr->page_size = ib_umem_find_best_pgsz(region, SZ_4K | SZ_2M | SZ_1G, virt); + if (unlikely(!iwmr->page_size)) { + kfree(iwmr); + ib_umem_release(region); + return ERR_PTR(-EOPNOTSUPP); + } + } iwmr->len = region->length; iwpbl->user_base = virt; palloc = &iwpbl->pble_alloc; |