Commit d05da7e2 authored by Mark Bloch's avatar Mark Bloch Committed by Ben Hutchings

IB/core: Avoid unsigned int overflow in sg_alloc_table

commit 3c7ba576 upstream.

sg_alloc_table gets unsigned int as parameter while the driver
returns it as size_t. Check npages isn't greater than maximum
unsigned int.

Fixes: eeb8461e ("IB: Refactor umem to use linear SG table")
Signed-off-by: default avatarMark Bloch <markb@mellanox.com>
Signed-off-by: default avatarMaor Gottlieb <maorg@mellanox.com>
Signed-off-by: default avatarLeon Romanovsky <leon@kernel.org>
Signed-off-by: default avatarDoug Ledford <dledford@redhat.com>
Signed-off-by: default avatarBen Hutchings <ben@decadent.org.uk>
parent 8ad2c099
......@@ -156,7 +156,7 @@ struct ib_umem *ib_umem_get(struct ib_ucontext *context, unsigned long addr,
cur_base = addr & PAGE_MASK;
if (npages == 0) {
if (npages == 0 || npages > UINT_MAX) {
ret = -EINVAL;
goto out;
}
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment