| Message ID | 1637599733-11096-1-git-send-email-haakon.bugge@oracle.com (mailing list archive) |
|---|---|
| State | Superseded |
| Headers | show |
| Series | [for-rc] RDMA/cma: Remove open coding for overflow in cma_connect_ib | expand |
On Mon, Nov 22, 2021 at 05:48:53PM +0100, Håkon Bugge wrote: > The existing test is a little hard to comprehend. Use > check_add_overflow() instead. > > Fixes: 04ded1672402 ("RDMA/cma: Verify private data length") > Signed-off-by: Håkon Bugge <haakon.bugge@oracle.com> > --- > drivers/infiniband/core/cma.c | 3 +-- > 1 file changed, 1 insertion(+), 2 deletions(-) > > diff --git a/drivers/infiniband/core/cma.c b/drivers/infiniband/core/cma.c > index 835ac54..0435768 100644 > --- a/drivers/infiniband/core/cma.c > +++ b/drivers/infiniband/core/cma.c > @@ -4093,8 +4093,7 @@ static int cma_connect_ib(struct rdma_id_private *id_priv, > > memset(&req, 0, sizeof req); > offset = cma_user_data_offset(id_priv); > - req.private_data_len = offset + conn_param->private_data_len; > - if (req.private_data_len < conn_param->private_data_len) > + if (check_add_overflow(offset, conn_param->private_data_len, &req.private_data_len)) > return -EINVAL; The same check exists in cma_resolve_ib_udp too. Thanks > > if (req.private_data_len) { > -- > 1.8.3.1 >
> On 23 Nov 2021, at 10:11, Leon Romanovsky <leon@kernel.org> wrote: > > On Mon, Nov 22, 2021 at 05:48:53PM +0100, Håkon Bugge wrote: >> The existing test is a little hard to comprehend. Use >> check_add_overflow() instead. >> >> Fixes: 04ded1672402 ("RDMA/cma: Verify private data length") >> Signed-off-by: Håkon Bugge <haakon.bugge@oracle.com> >> --- >> drivers/infiniband/core/cma.c | 3 +-- >> 1 file changed, 1 insertion(+), 2 deletions(-) >> >> diff --git a/drivers/infiniband/core/cma.c b/drivers/infiniband/core/cma.c >> index 835ac54..0435768 100644 >> --- a/drivers/infiniband/core/cma.c >> +++ b/drivers/infiniband/core/cma.c >> @@ -4093,8 +4093,7 @@ static int cma_connect_ib(struct rdma_id_private *id_priv, >> >> memset(&req, 0, sizeof req); >> offset = cma_user_data_offset(id_priv); >> - req.private_data_len = offset + conn_param->private_data_len; >> - if (req.private_data_len < conn_param->private_data_len) >> + if (check_add_overflow(offset, conn_param->private_data_len, &req.private_data_len)) >> return -EINVAL; > > The same check exists in cma_resolve_ib_udp too. Thanks for pointing it out Leon. Will send a v2. Thxs, Håkon > > Thanks > >> >> if (req.private_data_len) { >> -- >> 1.8.3.1
> On 23 Nov 2021, at 10:50, Haakon Bugge <haakon.bugge@oracle.com> wrote: > > > >> On 23 Nov 2021, at 10:11, Leon Romanovsky <leon@kernel.org> wrote: >> >> On Mon, Nov 22, 2021 at 05:48:53PM +0100, Håkon Bugge wrote: >>> The existing test is a little hard to comprehend. Use >>> check_add_overflow() instead. >>> >>> Fixes: 04ded1672402 ("RDMA/cma: Verify private data length") >>> Signed-off-by: Håkon Bugge <haakon.bugge@oracle.com> >>> --- >>> drivers/infiniband/core/cma.c | 3 +-- >>> 1 file changed, 1 insertion(+), 2 deletions(-) >>> >>> diff --git a/drivers/infiniband/core/cma.c b/drivers/infiniband/core/cma.c >>> index 835ac54..0435768 100644 >>> --- a/drivers/infiniband/core/cma.c >>> +++ b/drivers/infiniband/core/cma.c >>> @@ -4093,8 +4093,7 @@ static int cma_connect_ib(struct rdma_id_private *id_priv, >>> >>> memset(&req, 0, sizeof req); >>> offset = cma_user_data_offset(id_priv); >>> - req.private_data_len = offset + conn_param->private_data_len; >>> - if (req.private_data_len < conn_param->private_data_len) >>> + if (check_add_overflow(offset, conn_param->private_data_len, &req.private_data_len)) >>> return -EINVAL; >> >> The same check exists in cma_resolve_ib_udp too. > > Thanks for pointing it out Leon. Will send a v2. Be aware, will change $Subject slightly. Håkon > > > Thxs, Håkon > >> >> Thanks >> >>> >>> if (req.private_data_len) { >>> -- >>> 1.8.3.1
diff --git a/drivers/infiniband/core/cma.c b/drivers/infiniband/core/cma.c index 835ac54..0435768 100644 --- a/drivers/infiniband/core/cma.c +++ b/drivers/infiniband/core/cma.c @@ -4093,8 +4093,7 @@ static int cma_connect_ib(struct rdma_id_private *id_priv, memset(&req, 0, sizeof req); offset = cma_user_data_offset(id_priv); - req.private_data_len = offset + conn_param->private_data_len; - if (req.private_data_len < conn_param->private_data_len) + if (check_add_overflow(offset, conn_param->private_data_len, &req.private_data_len)) return -EINVAL; if (req.private_data_len) {
The existing test is a little hard to comprehend. Use check_add_overflow() instead. Fixes: 04ded1672402 ("RDMA/cma: Verify private data length") Signed-off-by: Håkon Bugge <haakon.bugge@oracle.com> --- drivers/infiniband/core/cma.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-)