Commit c1e91244 authored by Jason Gunthorpe's avatar Jason Gunthorpe Committed by Yang Yingliang
Browse files

RDMA/hns: Prevent undefined behavior in hns_roce_set_user_sq_size()

mainline  inclusion
from mainline-v5.5
commit 515f6000
category: bugfix
bugzilla: NA
CVE: NA

The "ucmd->log_sq_bb_count" variable is a user controlled variable in the
0-255 range.  If we shift more than then number of bits in an int then
it's undefined behavior (it shift wraps), and potentially the int could
become negative.

Fixes: 9a443537 ("IB/hns: Add driver files for hns RoCE driver")
Link: https://lore.kernel.org/r/20190608092514.GC28890@mwanda


Reported-by: default avatarDan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: default avatarJason Gunthorpe <jgg@mellanox.com>
Reviewed-by: default avatarDan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: default avatarShunfeng Yang <yangshunfeng2@huawei.com>
Reviewed-by: default avatarchunzhi hu <huchunzhi@huawei.com>
Signed-off-by: default avatarYang Yingliang <yangyingliang@huawei.com>
parent 53a6778b
Loading
Loading
Loading
Loading
0% Loading or .
You are about to add 0 people to the discussion. Proceed with caution.
Please to comment