Commit 47d87f71 authored by Dan Carpenter's avatar Dan Carpenter Committed by Jeffrey Hugo
Browse files

accel/qaic: Add consistent integer overflow checks 



The encode_dma() function has integer overflow checks.  The
encode_passthrough(), encode_activate() and encode_status() functions
did not.  I added integer overflow checking everywhere.  I also
updated the integer overflow checking in encode_dma() to use size_add()
so everything is consistent.

Fixes: 129776ac ("accel/qaic: Add control path")
Signed-off-by: default avatarDan Carpenter <dan.carpenter@linaro.org>
Reviewed-by: default avatarPranjal Ramajor Asha Kanojiya <quic_pkanojiy@quicinc.com>
Reviewed-by: default avatarJeffrey Hugo <quic_jhugo@quicinc.com>
Cc: stable@vger.kernel.org # 6.4.x
[jhugo: tweak if in encode_dma() to match existing style]
Signed-off-by: default avatarJeffrey Hugo <quic_jhugo@quicinc.com>
Link: https://patchwork.freedesktop.org/patch/msgid/ZK0Q7IsPkj6WSCcL@moroto
parent 51b56382

drivers/accel/qaic/qaic_control.c

+4 −7
Original line number Diff line number Diff line
@@ -367,7 +367,7 @@ static int encode_passthrough(struct qaic_device *qdev, void *trans, struct wrap 
	if (in_trans->hdr.len % 8 != 0)

		return -EINVAL;



	if (msg_hdr_len + in_trans->hdr.len > QAIC_MANAGE_EXT_MSG_LENGTH)

	if (size_add(msg_hdr_len, in_trans->hdr.len) > QAIC_MANAGE_EXT_MSG_LENGTH)

		return -ENOSPC;



	trans_wrapper = add_wrapper(wrappers,
@@ -558,11 +558,8 @@ static int encode_dma(struct qaic_device *qdev, void *trans, struct wrapper_list 
	msg = &wrapper->msg;

	msg_hdr_len = le32_to_cpu(msg->hdr.len);



	if (msg_hdr_len > (UINT_MAX - QAIC_MANAGE_EXT_MSG_LENGTH))

		return -EINVAL;



	/* There should be enough space to hold at least one ASP entry. */

	if (msg_hdr_len + sizeof(*out_trans) + sizeof(struct wire_addr_size_pair) >

	if (size_add(msg_hdr_len, sizeof(*out_trans) + sizeof(struct wire_addr_size_pair)) >

	    QAIC_MANAGE_EXT_MSG_LENGTH)

		return -ENOMEM;
@@ -635,7 +632,7 @@ static int encode_activate(struct qaic_device *qdev, void *trans, struct wrapper 
	msg = &wrapper->msg;

	msg_hdr_len = le32_to_cpu(msg->hdr.len);



	if (msg_hdr_len + sizeof(*out_trans) > QAIC_MANAGE_MAX_MSG_LENGTH)

	if (size_add(msg_hdr_len, sizeof(*out_trans)) > QAIC_MANAGE_MAX_MSG_LENGTH)

		return -ENOSPC;



	if (!in_trans->queue_size)
@@ -719,7 +716,7 @@ static int encode_status(struct qaic_device *qdev, void *trans, struct wrapper_l 
	msg = &wrapper->msg;

	msg_hdr_len = le32_to_cpu(msg->hdr.len);



	if (msg_hdr_len + in_trans->hdr.len > QAIC_MANAGE_MAX_MSG_LENGTH)

	if (size_add(msg_hdr_len, in_trans->hdr.len) > QAIC_MANAGE_MAX_MSG_LENGTH)

		return -ENOSPC;



	trans_wrapper = add_wrapper(wrappers, sizeof(*trans_wrapper));