From patchwork Wed Jun 21 07:22:18 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Dan Carpenter X-Patchwork-Id: 13286788 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from gabe.freedesktop.org (gabe.freedesktop.org [131.252.210.177]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id 18324EB64D7 for ; Wed, 21 Jun 2023 07:22:28 +0000 (UTC) Received: from gabe.freedesktop.org (localhost [127.0.0.1]) by gabe.freedesktop.org (Postfix) with ESMTP id 6135B10E3D2; Wed, 21 Jun 2023 07:22:27 +0000 (UTC) Received: from mail-wm1-x329.google.com (mail-wm1-x329.google.com [IPv6:2a00:1450:4864:20::329]) by gabe.freedesktop.org (Postfix) with ESMTPS id C79E810E3D2 for ; Wed, 21 Jun 2023 07:22:25 +0000 (UTC) Received: by mail-wm1-x329.google.com with SMTP id 5b1f17b1804b1-3f90b8acefdso32879305e9.1 for ; Wed, 21 Jun 2023 00:22:25 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linaro.org; s=google; t=1687332144; x=1689924144; h=in-reply-to:content-disposition:mime-version:message-id:subject:cc :to:from:date:from:to:cc:subject:date:message-id:reply-to; bh=6LvoAnY92IhuYKxUcIFqiF0B336ukPa8jJhL/uMvwzE=; b=fqb+Lk5qFDdI8tsOo384wsahnjd07gLKH1f6HgdRNIZpDEu+zO/YTZuQ+XhyUm9pmz 4wK6gc/xZRmxT+Km9H9lXKMZT2or6+NA5NV/jRz9cP6EmBe9LuOdxICsvgPUs2qXU9Uv C5lFzWsrnwKKWtNg0XXySJ/s4z5KGXWz9pXGESAOmufwh5ZplHXxaOjS4oO1KlEXpOy5 RmhJ+ZatkFLeblkVSgBQwQc7S81DhxysHCXiI/Cs/wGlRSNMsNUaSRRM4/1YeJmJYQrr 3noxF2mMjzVStM7K7wELhUlk6eCqHCXBXl2RNoiI1v4ZHKChof/0ugZk2t7Ue+bsE2N+ 6YIw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20221208; t=1687332144; x=1689924144; h=in-reply-to:content-disposition:mime-version:message-id:subject:cc :to:from:date:x-gm-message-state:from:to:cc:subject:date:message-id :reply-to; bh=6LvoAnY92IhuYKxUcIFqiF0B336ukPa8jJhL/uMvwzE=; b=JlsA8BhzWKciWYBpdh4hziND47ym0Rc2hVj8FhQZT9FDFRH5145UXRmc+hiYQcoyHn HI/oIQAhe7XuHrDlSk9EnNO47U+E7HuFCEErbGq1NP9hQnScLzZ0JUtfmMDmbEc0SDmg tkzIGjDFvTDj0Yza2AXpzvpRTfE9m9vvvGuNSAx74h6UG0xAqwESLiUrTogoZJwnpsF2 AnPvhOWVEmgVKSS7Z1U/IDkdP8TRFAky3eH6gMGqqUxtEHpy3VL27uaBVGl5CVOl5Xi0 Z+9uD7Kl8RC0gqWMHQH42nPPRHjMz5/00NoC74gkuGSewBpCmrYtiukSCyJUoj9Sren8 DCtQ== X-Gm-Message-State: AC+VfDxQGUjKdA8/up+ytPNHBVTSkGYgAk33Im9RXQq4hof1pczU1j+7 k2Pflz8VfXHz/+ee9koKsvY0bw== X-Google-Smtp-Source: ACHHUZ4OLioLcbMLtIFKz0PjiB4ajmxMhMKaALqVWaK0zxD//PQ2N3/uhDiKEOVC0pJwRkD5gwXahA== X-Received: by 2002:a05:600c:211a:b0:3f6:e59:c04c with SMTP id u26-20020a05600c211a00b003f60e59c04cmr10030649wml.24.1687332143848; Wed, 21 Jun 2023 00:22:23 -0700 (PDT) Received: from localhost ([102.36.222.112]) by smtp.gmail.com with ESMTPSA id l5-20020a1ced05000000b003f70a7b4537sm15211480wmh.36.2023.06.21.00.22.21 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 21 Jun 2023 00:22:22 -0700 (PDT) Date: Wed, 21 Jun 2023 10:22:18 +0300 From: Dan Carpenter To: Jeffrey Hugo Subject: [PATCH 4/5] accel/qaic: move and expand integer overflow checks for map_user_pages() Message-ID: <435abccc-9251-4c27-9b35-8fdf4bbd2433@moroto.mountain> MIME-Version: 1.0 Content-Disposition: inline In-Reply-To: X-Mailer: git-send-email haha only kidding X-BeenThere: dri-devel@lists.freedesktop.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Direct Rendering Infrastructure - Development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: linux-arm-msm@vger.kernel.org, Oded Gabbay , kernel-janitors@vger.kernel.org, dri-devel@lists.freedesktop.org, Pranjal Ramajor Asha Kanojiya , Stanislaw Gruszka , Carl Vanderlip , Jacek Lawrynowicz Errors-To: dri-devel-bounces@lists.freedesktop.org Sender: "dri-devel" The integer overflow checking for find_and_map_user_pages() was done in encode_dma(). Presumably this was to do it before the allocation. But it's not super important that the failure path is a fast path and it hurts readability to put the check so far from the where the variable is used. Move the check to find_and_map_user_pages() instead and add some more additional potential integer overflow checks. Fixes: 129776ac2e38 ("accel/qaic: Add control path") Signed-off-by: Dan Carpenter --- I kind of went to town adding integer overflow checks here. Please, review this extra carefully. drivers/accel/qaic/qaic_control.c | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) diff --git a/drivers/accel/qaic/qaic_control.c b/drivers/accel/qaic/qaic_control.c index 96a26539df18..03932197f1ac 100644 --- a/drivers/accel/qaic/qaic_control.c +++ b/drivers/accel/qaic/qaic_control.c @@ -401,6 +401,12 @@ static int find_and_map_user_pages(struct qaic_device *qdev, xfer_start_addr = in_trans->addr + resources->xferred_dma_size; + if (in_trans->size == 0 || + in_trans->addr + in_trans->size < in_trans->addr || + in_trans->addr + resources->xferred_dma_size < in_trans->addr || + in_trans->size + offset_in_page(xfer_start_addr) < resources->xferred_dma_size) + return -EINVAL; + need_pages = DIV_ROUND_UP(in_trans->size + offset_in_page(xfer_start_addr) - resources->xferred_dma_size, PAGE_SIZE); @@ -563,9 +569,6 @@ static int encode_dma(struct qaic_device *qdev, void *trans, struct wrapper_list QAIC_MANAGE_EXT_MSG_LENGTH) return -ENOMEM; - if (in_trans->addr + in_trans->size < in_trans->addr || !in_trans->size) - return -EINVAL; - xfer = kmalloc(sizeof(*xfer), GFP_KERNEL); if (!xfer) return -ENOMEM;