Skip to content

Commit 9cfe6ab

Browse files
zmckevitquic-jhugo
authored andcommitted
accel/qaic: Use check_add_overflow in sahara for 64b types
Use check_add_overflow instead of size_add in sahara when 64b types are being added to ensure compatibility with 32b systems. The size_add function parameters are of size_t, so 64b data types may be truncated when cast to size_t on 32b systems. When using check_add_overflow, no type casts are made, making it a more portable option. Signed-off-by: Zack McKevitt <zmckevit@qti.qualcomm.com> Signed-off-by: Youssef Samir <youssef.abdulrahman@oss.qualcomm.com> Reviewed-by: Jeff Hugo <jeff.hugo@oss.qualcomm.com> Reviewed-by: Carl Vanderlip <carl.vanderlip@oss.qualcomm.com> Signed-off-by: Jeff Hugo <jeff.hugo@oss.qualcomm.com> Link: https://lore.kernel.org/r/20251015165408.213645-1-youssef.abdulrahman@oss.qualcomm.com
1 parent 4e39740 commit 9cfe6ab

1 file changed

Lines changed: 11 additions & 6 deletions

File tree

drivers/accel/qaic/sahara.c

Lines changed: 11 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -575,6 +575,7 @@ static void sahara_parse_dump_table(struct sahara_context *context)
575575
struct sahara_memory_dump_meta_v1 *dump_meta;
576576
u64 table_nents;
577577
u64 dump_length;
578+
u64 mul_bytes;
578579
int ret;
579580
u64 i;
580581

@@ -588,8 +589,9 @@ static void sahara_parse_dump_table(struct sahara_context *context)
588589
dev_table[i].description[SAHARA_TABLE_ENTRY_STR_LEN - 1] = 0;
589590
dev_table[i].filename[SAHARA_TABLE_ENTRY_STR_LEN - 1] = 0;
590591

591-
dump_length = size_add(dump_length, le64_to_cpu(dev_table[i].length));
592-
if (dump_length == SIZE_MAX) {
592+
if (check_add_overflow(dump_length,
593+
le64_to_cpu(dev_table[i].length),
594+
&dump_length)) {
593595
/* Discard the dump */
594596
sahara_send_reset(context);
595597
return;
@@ -605,14 +607,17 @@ static void sahara_parse_dump_table(struct sahara_context *context)
605607
dev_table[i].filename);
606608
}
607609

608-
dump_length = size_add(dump_length, sizeof(*dump_meta));
609-
if (dump_length == SIZE_MAX) {
610+
if (check_add_overflow(dump_length, (u64)sizeof(*dump_meta), &dump_length)) {
610611
/* Discard the dump */
611612
sahara_send_reset(context);
612613
return;
613614
}
614-
dump_length = size_add(dump_length, size_mul(sizeof(*image_out_table), table_nents));
615-
if (dump_length == SIZE_MAX) {
615+
if (check_mul_overflow((u64)sizeof(*image_out_table), table_nents, &mul_bytes)) {
616+
/* Discard the dump */
617+
sahara_send_reset(context);
618+
return;
619+
}
620+
if (check_add_overflow(dump_length, mul_bytes, &dump_length)) {
616621
/* Discard the dump */
617622
sahara_send_reset(context);
618623
return;

0 commit comments

Comments
 (0)