OSDN Git Service

RDMA/hns: Prevent undefined behavior in hns_roce_set_user_sq_size()
authorJason Gunthorpe <jgg@mellanox.com>
Sat, 8 Jun 2019 09:25:14 +0000 (12:25 +0300)
committerJason Gunthorpe <jgg@mellanox.com>
Mon, 28 Oct 2019 14:20:34 +0000 (11:20 -0300)
commit515f60004ed985d2b2f03659365752e0b6142986
tree0861328fdec133b95f3565647df20cf44fdd1620
parent24f52149230454249ae628b922f741036e83b84c
RDMA/hns: Prevent undefined behavior in hns_roce_set_user_sq_size()

The "ucmd->log_sq_bb_count" variable is a user controlled variable in the
0-255 range.  If we shift more than then number of bits in an int then
it's undefined behavior (it shift wraps), and potentially the int could
become negative.

Fixes: 9a4435375cd1 ("IB/hns: Add driver files for hns RoCE driver")
Link: https://lore.kernel.org/r/20190608092514.GC28890@mwanda
Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
Reviewed-by: Dan Carpenter <dan.carpenter@oracle.com>
drivers/infiniband/hw/hns/hns_roce_qp.c