Commit c2b37f76 authored by Boris Pismenny's avatar Boris Pismenny Committed by Doug Ledford

IB/mlx5: Fix integer overflows in mlx5_ib_create_srq

This patch validates user provided input to prevent integer overflow due
to integer manipulation in the mlx5_ib_create_srq function.

Cc: syzkaller <syzkaller@googlegroups.com>
Fixes: e126ba97 ("mlx5: Add driver for Mellanox Connect-IB adapters")
Signed-off-by: default avatarBoris Pismenny <borisp@mellanox.com>
Signed-off-by: default avatarLeon Romanovsky <leon@kernel.org>
Signed-off-by: default avatarDoug Ledford <dledford@redhat.com>
parent 2c292dbb
...@@ -241,8 +241,8 @@ struct ib_srq *mlx5_ib_create_srq(struct ib_pd *pd, ...@@ -241,8 +241,8 @@ struct ib_srq *mlx5_ib_create_srq(struct ib_pd *pd,
{ {
struct mlx5_ib_dev *dev = to_mdev(pd->device); struct mlx5_ib_dev *dev = to_mdev(pd->device);
struct mlx5_ib_srq *srq; struct mlx5_ib_srq *srq;
int desc_size; size_t desc_size;
int buf_size; size_t buf_size;
int err; int err;
struct mlx5_srq_attr in = {0}; struct mlx5_srq_attr in = {0};
__u32 max_srq_wqes = 1 << MLX5_CAP_GEN(dev->mdev, log_max_srq_sz); __u32 max_srq_wqes = 1 << MLX5_CAP_GEN(dev->mdev, log_max_srq_sz);
...@@ -266,15 +266,18 @@ struct ib_srq *mlx5_ib_create_srq(struct ib_pd *pd, ...@@ -266,15 +266,18 @@ struct ib_srq *mlx5_ib_create_srq(struct ib_pd *pd,
desc_size = sizeof(struct mlx5_wqe_srq_next_seg) + desc_size = sizeof(struct mlx5_wqe_srq_next_seg) +
srq->msrq.max_gs * sizeof(struct mlx5_wqe_data_seg); srq->msrq.max_gs * sizeof(struct mlx5_wqe_data_seg);
if (desc_size == 0 || srq->msrq.max_gs > desc_size)
return ERR_PTR(-EINVAL);
desc_size = roundup_pow_of_two(desc_size); desc_size = roundup_pow_of_two(desc_size);
desc_size = max_t(int, 32, desc_size); desc_size = max_t(size_t, 32, desc_size);
if (desc_size < sizeof(struct mlx5_wqe_srq_next_seg))
return ERR_PTR(-EINVAL);
srq->msrq.max_avail_gather = (desc_size - sizeof(struct mlx5_wqe_srq_next_seg)) / srq->msrq.max_avail_gather = (desc_size - sizeof(struct mlx5_wqe_srq_next_seg)) /
sizeof(struct mlx5_wqe_data_seg); sizeof(struct mlx5_wqe_data_seg);
srq->msrq.wqe_shift = ilog2(desc_size); srq->msrq.wqe_shift = ilog2(desc_size);
buf_size = srq->msrq.max * desc_size; buf_size = srq->msrq.max * desc_size;
mlx5_ib_dbg(dev, "desc_size 0x%x, req wr 0x%x, srq size 0x%x, max_gs 0x%x, max_avail_gather 0x%x\n", if (buf_size < desc_size)
desc_size, init_attr->attr.max_wr, srq->msrq.max, srq->msrq.max_gs, return ERR_PTR(-EINVAL);
srq->msrq.max_avail_gather);
in.type = init_attr->srq_type; in.type = init_attr->srq_type;
if (pd->uobject) if (pd->uobject)
......
...@@ -453,8 +453,8 @@ struct mlx5_core_srq { ...@@ -453,8 +453,8 @@ struct mlx5_core_srq {
struct mlx5_core_rsc_common common; /* must be first */ struct mlx5_core_rsc_common common; /* must be first */
u32 srqn; u32 srqn;
int max; int max;
int max_gs; size_t max_gs;
int max_avail_gather; size_t max_avail_gather;
int wqe_shift; int wqe_shift;
void (*event) (struct mlx5_core_srq *, enum mlx5_event); void (*event) (struct mlx5_core_srq *, enum mlx5_event);
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment