]> git.baikalelectronics.ru Git - kernel.git/commit
RDMA/hns: Prevent undefined behavior in hns_roce_set_user_sq_size()
authorJason Gunthorpe <jgg@mellanox.com>
Sat, 8 Jun 2019 09:25:14 +0000 (12:25 +0300)
committerJason Gunthorpe <jgg@mellanox.com>
Mon, 28 Oct 2019 14:20:34 +0000 (11:20 -0300)
commit861d09eaeb1d1dc912d2e076c7decd5d35502c11
tree0861328fdec133b95f3565647df20cf44fdd1620
parentaeaf24fcf8f93fe1a7b1c1e12f648b05bc81efa1
RDMA/hns: Prevent undefined behavior in hns_roce_set_user_sq_size()

The "ucmd->log_sq_bb_count" variable is a user controlled variable in the
0-255 range.  If we shift more than then number of bits in an int then
it's undefined behavior (it shift wraps), and potentially the int could
become negative.

Fixes: 87c28d1fc442 ("IB/hns: Add driver files for hns RoCE driver")
Link: https://lore.kernel.org/r/20190608092514.GC28890@mwanda
Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
Reviewed-by: Dan Carpenter <dan.carpenter@oracle.com>
drivers/infiniband/hw/hns/hns_roce_qp.c