diff options
| author | Dan Carpenter <dan.carpenter@oracle.com> | 2019-08-21 10:11:22 +0300 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2019-08-23 00:28:10 +0300 |
| commit | 6123f1fe53985645992b2ff648b3087b77b3ed16 (patch) | |
| tree | ac8aa27582f93b48953bb335e0a1252bb0f1bf58 /drivers/misc/xilinx_sdfec.c | |
| parent | 56a635c0ec14950bd6a5bfb4d9d497897f64179f (diff) | |
| download | linux-6123f1fe53985645992b2ff648b3087b77b3ed16.tar.xz | |
misc: xilinx_sdfec: Prevent integer overflow in xsdfec_table_write()
The checking here needs to handle integer overflows because "offset" and
"len" come from the user.
Fixes: 20ec628e8007 ("misc: xilinx_sdfec: Add ability to configure LDPC")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Reviewed-by: Michal Simek <michal.simek@xilinx.com>
Reviewed-by: Dragan Cvetic <dragan.cvetic@xilinx.com>
Link: https://lore.kernel.org/r/20190821071122.GD26957@mwanda
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Diffstat (limited to 'drivers/misc/xilinx_sdfec.c')
| -rw-r--r-- | drivers/misc/xilinx_sdfec.c | 4 |
1 files changed, 3 insertions, 1 deletions
diff --git a/drivers/misc/xilinx_sdfec.c b/drivers/misc/xilinx_sdfec.c index 3fc53d20abf3..0bf3bcc8e1ef 100644 --- a/drivers/misc/xilinx_sdfec.c +++ b/drivers/misc/xilinx_sdfec.c @@ -611,7 +611,9 @@ static int xsdfec_table_write(struct xsdfec_dev *xsdfec, u32 offset, * Writes that go beyond the length of * Shared Scale(SC) table should fail */ - if ((XSDFEC_REG_WIDTH_JUMP * (offset + len)) > depth) { + if (offset > depth / XSDFEC_REG_WIDTH_JUMP || + len > depth / XSDFEC_REG_WIDTH_JUMP || + offset + len > depth / XSDFEC_REG_WIDTH_JUMP) { dev_dbg(xsdfec->dev, "Write exceeds SC table length"); return -EINVAL; } |