Unverified Commit 8f257bb1 authored by openeuler-ci-bot's avatar openeuler-ci-bot Committed by Gitee
Browse files

!9113 IB/qib: Protect from buffer 

Merge Pull Request from: @ci-robot 
 
PR sync from: Zeng Heng <zengheng4@huawei.com>
https://mailweb.openeuler.org/hyperkitty/list/kernel@openeuler.org/message/REVZVPCM2CWV2S6467JLLX275H2QEV47/ 
José Expósito (1):
  IB/qib: Fix memory leak in qib_user_sdma_queue_pkts()

Mike Marciniszyn (1):
  IB/qib: Protect from buffer overflow in struct qib_user_sdma_pkt
    fields


--
2.25.1
 
https://gitee.com/src-openeuler/kernel/issues/I9RD02 
 
Link:https://gitee.com/openeuler/kernel/pulls/9113

 

Reviewed-by: default avatarLiu YongQiang <liuyongqiang13@huawei.com>
Reviewed-by: default avatarYue Haibing <yuehaibing@huawei.com>
Signed-off-by: default avatarZhang Changzhong <zhangchangzhong@huawei.com>
parents 297a8114 68440cf0

drivers/infiniband/hw/qib/qib_user_sdma.c

+23 −9
Original line number Diff line number Diff line
@@ -606,7 +606,7 @@ static int qib_user_sdma_coalesce(const struct qib_devdata *dd, 
/*

 * How many pages in this iovec element?

 */

static int qib_user_sdma_num_pages(const struct iovec *iov)

static size_t qib_user_sdma_num_pages(const struct iovec *iov)

{

	const unsigned long addr  = (unsigned long) iov->iov_base;

	const unsigned long  len  = iov->iov_len;
@@ -662,7 +662,7 @@ static void qib_user_sdma_free_pkt_frag(struct device *dev, 
static int qib_user_sdma_pin_pages(const struct qib_devdata *dd,

				   struct qib_user_sdma_queue *pq,

				   struct qib_user_sdma_pkt *pkt,

				   unsigned long addr, int tlen, int npages)

				   unsigned long addr, int tlen, size_t npages)

{

	struct page *pages[8];

	int i, j;
@@ -726,7 +726,7 @@ static int qib_user_sdma_pin_pkt(const struct qib_devdata *dd, 
	unsigned long idx;



	for (idx = 0; idx < niov; idx++) {

		const int npages = qib_user_sdma_num_pages(iov + idx);

		const size_t npages = qib_user_sdma_num_pages(iov + idx);

		const unsigned long addr = (unsigned long) iov[idx].iov_base;



		ret = qib_user_sdma_pin_pages(dd, pq, pkt, addr,
@@ -828,8 +828,8 @@ static int qib_user_sdma_queue_pkts(const struct qib_devdata *dd, 
		unsigned pktnw;

		unsigned pktnwc;

		int nfrags = 0;

		int npages = 0;

		int bytes_togo = 0;

		size_t npages = 0;

		size_t bytes_togo = 0;

		int tiddma = 0;

		int cfur;
@@ -889,7 +889,11 @@ static int qib_user_sdma_queue_pkts(const struct qib_devdata *dd, 


			npages += qib_user_sdma_num_pages(&iov[idx]);



			bytes_togo += slen;

			if (check_add_overflow(bytes_togo, slen, &bytes_togo) ||

			    bytes_togo > type_max(typeof(pkt->bytes_togo))) {

				ret = -EINVAL;

				goto free_pbc;

			}

			pktnwc += slen >> 2;

			idx++;

			nfrags++;
@@ -908,7 +912,7 @@ static int qib_user_sdma_queue_pkts(const struct qib_devdata *dd, 
		}



		if (frag_size) {

			int pktsize, tidsmsize, n;

			size_t tidsmsize, n, pktsize, sz, addrlimit;



			n = npages*((2*PAGE_SIZE/frag_size)+1);

			pktsize = sizeof(*pkt) + sizeof(pkt->addr[0])*n;
@@ -926,14 +930,24 @@ static int qib_user_sdma_queue_pkts(const struct qib_devdata *dd, 
			else

				tidsmsize = 0;



			pkt = kmalloc(pktsize+tidsmsize, GFP_KERNEL);

			if (check_add_overflow(pktsize, tidsmsize, &sz)) {

				ret = -EINVAL;

				goto free_pbc;

			}

			pkt = kmalloc(sz, GFP_KERNEL);

			if (!pkt) {

				ret = -ENOMEM;

				goto free_pbc;

			}

			pkt->largepkt = 1;

			pkt->frag_size = frag_size;

			pkt->addrlimit = n + ARRAY_SIZE(pkt->addr);

			if (check_add_overflow(n, ARRAY_SIZE(pkt->addr),

					       &addrlimit) ||

			    addrlimit > type_max(typeof(pkt->addrlimit))) {

				ret = -EINVAL;

				goto free_pkt;

			}

			pkt->addrlimit = addrlimit;



			if (tiddma) {

				char *tidsm = (char *)pkt + pktsize;