Skip to content

Commit 96d3c1c

Browse files
Dan Carpenterquic-jhugo
authored andcommitted
accel/qaic: Clean up integer overflow checking in map_user_pages()
The encode_dma() function has some validation on in_trans->size but it would be more clear to move those checks to find_and_map_user_pages(). The encode_dma() had two checks: if (in_trans->addr + in_trans->size < in_trans->addr || !in_trans->size) return -EINVAL; The in_trans->addr variable is the starting address. The in_trans->size variable is the total size of the transfer. The transfer can occur in parts and the resources->xferred_dma_size tracks how many bytes we have already transferred. This patch introduces a new variable "remaining" which represents the amount we want to transfer (in_trans->size) minus the amount we have already transferred (resources->xferred_dma_size). I have modified the check for if in_trans->size is zero to instead check if in_trans->size is less than resources->xferred_dma_size. If we have already transferred more bytes than in_trans->size then there are negative bytes remaining which doesn't make sense. If there are zero bytes remaining to be copied, just return success. The check in encode_dma() checked that "addr + size" could not overflow and barring a driver bug that should work, but it's easier to check if we do this in parts. First check that "in_trans->addr + resources->xferred_dma_size" is safe. Then check that "xfer_start_addr + remaining" is safe. My final concern was that we are dealing with u64 values but on 32bit systems the kmalloc() function will truncate the sizes to 32 bits. So I calculated "total = in_trans->size + offset_in_page(xfer_start_addr);" and returned -EINVAL if it were >= SIZE_MAX. This will not affect 64bit systems. Fixes: 129776a ("accel/qaic: Add control path") Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org> Reviewed-by: Jeffrey Hugo <quic_jhugo@quicinc.com> Reviewed-by: Carl Vanderlip <quic_carlv@quicinc.com> Signed-off-by: Jeffrey Hugo <quic_jhugo@quicinc.com> Link: https://patchwork.freedesktop.org/patch/msgid/24d3348b-25ac-4c1b-b171-9dae7c43e4e0@moroto.mountain
1 parent 2d95617 commit 96d3c1c

File tree

1 file changed

+18
-8
lines changed

1 file changed

+18
-8
lines changed

drivers/accel/qaic/qaic_control.c

Lines changed: 18 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -392,18 +392,31 @@ static int find_and_map_user_pages(struct qaic_device *qdev,
392392
struct qaic_manage_trans_dma_xfer *in_trans,
393393
struct ioctl_resources *resources, struct dma_xfer *xfer)
394394
{
395+
u64 xfer_start_addr, remaining, end, total;
395396
unsigned long need_pages;
396397
struct page **page_list;
397398
unsigned long nr_pages;
398399
struct sg_table *sgt;
399-
u64 xfer_start_addr;
400400
int ret;
401401
int i;
402402

403-
xfer_start_addr = in_trans->addr + resources->xferred_dma_size;
403+
if (check_add_overflow(in_trans->addr, resources->xferred_dma_size, &xfer_start_addr))
404+
return -EINVAL;
404405

405-
need_pages = DIV_ROUND_UP(in_trans->size + offset_in_page(xfer_start_addr) -
406-
resources->xferred_dma_size, PAGE_SIZE);
406+
if (in_trans->size < resources->xferred_dma_size)
407+
return -EINVAL;
408+
remaining = in_trans->size - resources->xferred_dma_size;
409+
if (remaining == 0)
410+
return 0;
411+
412+
if (check_add_overflow(xfer_start_addr, remaining, &end))
413+
return -EINVAL;
414+
415+
total = remaining + offset_in_page(xfer_start_addr);
416+
if (total >= SIZE_MAX)
417+
return -EINVAL;
418+
419+
need_pages = DIV_ROUND_UP(total, PAGE_SIZE);
407420

408421
nr_pages = need_pages;
409422

@@ -435,7 +448,7 @@ static int find_and_map_user_pages(struct qaic_device *qdev,
435448

436449
ret = sg_alloc_table_from_pages(sgt, page_list, nr_pages,
437450
offset_in_page(xfer_start_addr),
438-
in_trans->size - resources->xferred_dma_size, GFP_KERNEL);
451+
remaining, GFP_KERNEL);
439452
if (ret) {
440453
ret = -ENOMEM;
441454
goto free_sgt;
@@ -566,9 +579,6 @@ static int encode_dma(struct qaic_device *qdev, void *trans, struct wrapper_list
566579
QAIC_MANAGE_EXT_MSG_LENGTH)
567580
return -ENOMEM;
568581

569-
if (in_trans->addr + in_trans->size < in_trans->addr || !in_trans->size)
570-
return -EINVAL;
571-
572582
xfer = kmalloc(sizeof(*xfer), GFP_KERNEL);
573583
if (!xfer)
574584
return -ENOMEM;

0 commit comments

Comments
 (0)