Commit eba83a85 authored by Mark Bloch's avatar Mark Bloch Committed by Greg Kroah-Hartman

IB/core: Avoid unsigned int overflow in sg_alloc_table

commit 3c7ba576 upstream.

sg_alloc_table gets unsigned int as parameter while the driver
returns it as size_t. Check npages isn't greater than maximum
unsigned int.

Fixes: eeb8461e ("IB: Refactor umem to use linear SG table")
Signed-off-by: default avatarMark Bloch <markb@mellanox.com>
Signed-off-by: default avatarMaor Gottlieb <maorg@mellanox.com>
Signed-off-by: default avatarLeon Romanovsky <leon@kernel.org>
Signed-off-by: default avatarDoug Ledford <dledford@redhat.com>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent c524185c
...@@ -175,7 +175,7 @@ struct ib_umem *ib_umem_get(struct ib_ucontext *context, unsigned long addr, ...@@ -175,7 +175,7 @@ struct ib_umem *ib_umem_get(struct ib_ucontext *context, unsigned long addr,
cur_base = addr & PAGE_MASK; cur_base = addr & PAGE_MASK;
if (npages == 0) { if (npages == 0 || npages > UINT_MAX) {
ret = -EINVAL; ret = -EINVAL;
goto out; goto out;
} }
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment