| Message ID | 20190624214608.11765-1-colin.king@canonical.com (mailing list archive) |
|---|---|
| State | Mainlined |
| Commit | 7ef7587541d49c6de1c9650c3c819a7fdd7ade66 |
| Delegated to: | Jason Gunthorpe |
| Headers | show |
| Series | [next] RDMA/hns: fix potential integer overflow on left shift | expand |
On Mon, Jun 24, 2019 at 10:46:08PM +0100, Colin King wrote: > From: Colin Ian King <colin.king@canonical.com> > > There is a potential integer overflow when int i is left shifted > as this is evaluated using 32 bit arithmetic but is being used in > a context that expects an expression of type dma_addr_t. Fix this > by casting integer i to dma_addr_t before shifting to avoid the > overflow. > > Addresses-Coverity: ("Unintentional integer overflow") > Fixes: 2ac0bc5e725e ("RDMA/hns: Add a group interfaces for optimizing buffers getting flow") > Signed-off-by: Colin Ian King <colin.king@canonical.com> > --- > drivers/infiniband/hw/hns/hns_roce_alloc.c | 2 +- > 1 file changed, 1 insertion(+), 1 deletion(-) Applied to for-next, thanks Jason
diff --git a/drivers/infiniband/hw/hns/hns_roce_alloc.c b/drivers/infiniband/hw/hns/hns_roce_alloc.c index 14fcc359599c..2c8defa94107 100644 --- a/drivers/infiniband/hw/hns/hns_roce_alloc.c +++ b/drivers/infiniband/hw/hns/hns_roce_alloc.c @@ -257,7 +257,7 @@ int hns_roce_get_kmem_bufs(struct hns_roce_dev *hr_dev, dma_addr_t *bufs, for (i = start; i < end; i++) if (buf->nbufs == 1) bufs[total++] = buf->direct.map + - (i << buf->page_shift); + ((dma_addr_t)i << buf->page_shift); else bufs[total++] = buf->page_list[i].map;