]> git.baikalelectronics.ru Git - kernel.git/commit
RDMA/hns: Prevent undefined behavior in hns_roce_set_user_sq_size()
authorJason Gunthorpe <jgg@mellanox.com>
Sat, 8 Jun 2019 09:25:14 +0000 (12:25 +0300)
committerJason Gunthorpe <jgg@mellanox.com>
Mon, 28 Oct 2019 14:20:34 +0000 (11:20 -0300)
commitae157d968a7285e211dbae4fe4de8f625d2d8aef
tree0861328fdec133b95f3565647df20cf44fdd1620
parent676b5bc01b2cc33b0366abb47a084fe351fb8652
RDMA/hns: Prevent undefined behavior in hns_roce_set_user_sq_size()

The "ucmd->log_sq_bb_count" variable is a user controlled variable in the
0-255 range.  If we shift more than then number of bits in an int then
it's undefined behavior (it shift wraps), and potentially the int could
become negative.

Fixes: cd69dc18740f ("IB/hns: Add driver files for hns RoCE driver")
Link: https://lore.kernel.org/r/20190608092514.GC28890@mwanda
Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
Reviewed-by: Dan Carpenter <dan.carpenter@oracle.com>
drivers/infiniband/hw/hns/hns_roce_qp.c