diff options
| author | Allen Hubbe <Allen.Hubbe@emc.com> | 2015-07-13 15:07:13 +0300 |
|---|---|---|
| committer | Jon Mason <jdmason@kudzu.us> | 2015-08-09 23:32:22 +0300 |
| commit | 8c9edf63e75f036b42afb4502deb20bbfb5004b4 (patch) | |
| tree | e1a20719e91d54e26384642d8665854b44cb7ed7 /drivers | |
| parent | 8b5a22d8f18496f5921ccb92554a7051cbfd9b0c (diff) | |
| download | linux-8c9edf63e75f036b42afb4502deb20bbfb5004b4.tar.xz | |
NTB: Fix zero size or integer overflow in ntb_set_mw
A plain 32 bit integer will overflow for values over 4GiB.
Change the plain integer size to the appropriate size type in
ntb_set_mw. Change the type of the size parameter and two local
variables used for size.
Even if there is no overflow, a size of zero is invalid here.
Reported-by: Juyoung Jung <jjung@micron.com>
Signed-off-by: Allen Hubbe <Allen.Hubbe@emc.com>
Signed-off-by: Jon Mason <jdmason@kudzu.us>
Diffstat (limited to 'drivers')
| -rw-r--r-- | drivers/ntb/ntb_transport.c | 9 |
1 files changed, 6 insertions, 3 deletions
diff --git a/drivers/ntb/ntb_transport.c b/drivers/ntb/ntb_transport.c index b82171e3e07d..bc556e2d7f62 100644 --- a/drivers/ntb/ntb_transport.c +++ b/drivers/ntb/ntb_transport.c @@ -629,13 +629,16 @@ static void ntb_free_mw(struct ntb_transport_ctx *nt, int num_mw) } static int ntb_set_mw(struct ntb_transport_ctx *nt, int num_mw, - unsigned int size) + resource_size_t size) { struct ntb_transport_mw *mw = &nt->mw_vec[num_mw]; struct pci_dev *pdev = nt->ndev->pdev; - unsigned int xlat_size, buff_size; + size_t xlat_size, buff_size; int rc; + if (!size) + return -EINVAL; + xlat_size = round_up(size, mw->xlat_align_size); buff_size = round_up(size, mw->xlat_align); @@ -655,7 +658,7 @@ static int ntb_set_mw(struct ntb_transport_ctx *nt, int num_mw, if (!mw->virt_addr) { mw->xlat_size = 0; mw->buff_size = 0; - dev_err(&pdev->dev, "Unable to alloc MW buff of size %d\n", + dev_err(&pdev->dev, "Unable to alloc MW buff of size %zu\n", buff_size); return -ENOMEM; } |