diff options
| author | Olof Johansson <olof@lixom.net> | 2013-08-04 13:19:05 -0700 |
|---|---|---|
| committer | Olof Johansson <olof@lixom.net> | 2013-08-04 13:19:05 -0700 |
| commit | 6a33fc8cacfc7fac829c72bd321868be7e72f609 (patch) | |
| tree | ca8572f214a30c4743b731b4ab2809a980b78369 /net/sunrpc/xprtrdma | |
| parent | 3bd957978bb50390bb07678bc4c125989e9a81a2 (diff) | |
| parent | 2746a7c272a3242f919fa2fd5a5f2d9f8a41173a (diff) | |
| download | linux-rt-6a33fc8cacfc7fac829c72bd321868be7e72f609.tar.gz | |
Merge tag 'fixes-non-3.12' of git://git.infradead.org/linux-mvebu into next/fixes-non-critical
From Jason Cooper:
mvebu fixes-non-critical for v3.12
- dove
- fix section mismatch (all callers are already _init, so it's just a space
issue)
* tag 'fixes-non-3.12' of git://git.infradead.org/linux-mvebu:
ARM: dove: fix missing __init section of dove_mpp_gpio_mode
+ Linux 3.11-rc2
Signed-off-by: Olof Johansson <olof@lixom.net>
Diffstat (limited to 'net/sunrpc/xprtrdma')
| -rw-r--r-- | net/sunrpc/xprtrdma/svc_rdma_marshal.c | 20 |
1 files changed, 14 insertions, 6 deletions
diff --git a/net/sunrpc/xprtrdma/svc_rdma_marshal.c b/net/sunrpc/xprtrdma/svc_rdma_marshal.c index 8d2edddf48cf..65b146297f5a 100644 --- a/net/sunrpc/xprtrdma/svc_rdma_marshal.c +++ b/net/sunrpc/xprtrdma/svc_rdma_marshal.c @@ -98,6 +98,7 @@ void svc_rdma_rcl_chunk_counts(struct rpcrdma_read_chunk *ch, */ static u32 *decode_write_list(u32 *va, u32 *vaend) { + unsigned long start, end; int nchunks; struct rpcrdma_write_array *ary = @@ -113,9 +114,12 @@ static u32 *decode_write_list(u32 *va, u32 *vaend) return NULL; } nchunks = ntohl(ary->wc_nchunks); - if (((unsigned long)&ary->wc_array[0] + - (sizeof(struct rpcrdma_write_chunk) * nchunks)) > - (unsigned long)vaend) { + + start = (unsigned long)&ary->wc_array[0]; + end = (unsigned long)vaend; + if (nchunks < 0 || + nchunks > (SIZE_MAX - start) / sizeof(struct rpcrdma_write_chunk) || + (start + (sizeof(struct rpcrdma_write_chunk) * nchunks)) > end) { dprintk("svcrdma: ary=%p, wc_nchunks=%d, vaend=%p\n", ary, nchunks, vaend); return NULL; @@ -129,6 +133,7 @@ static u32 *decode_write_list(u32 *va, u32 *vaend) static u32 *decode_reply_array(u32 *va, u32 *vaend) { + unsigned long start, end; int nchunks; struct rpcrdma_write_array *ary = (struct rpcrdma_write_array *)va; @@ -143,9 +148,12 @@ static u32 *decode_reply_array(u32 *va, u32 *vaend) return NULL; } nchunks = ntohl(ary->wc_nchunks); - if (((unsigned long)&ary->wc_array[0] + - (sizeof(struct rpcrdma_write_chunk) * nchunks)) > - (unsigned long)vaend) { + + start = (unsigned long)&ary->wc_array[0]; + end = (unsigned long)vaend; + if (nchunks < 0 || + nchunks > (SIZE_MAX - start) / sizeof(struct rpcrdma_write_chunk) || + (start + (sizeof(struct rpcrdma_write_chunk) * nchunks)) > end) { dprintk("svcrdma: ary=%p, wc_nchunks=%d, vaend=%p\n", ary, nchunks, vaend); return NULL; |