tjh.dev / kernel
Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux
1
fork

Configure Feed

Select the types of activity you want to include in your feed.

accel/qaic: Use check_add_overflow in sahara for 64b types

Use check_add_overflow instead of size_add in sahara when
64b types are being added to ensure compatibility with 32b
systems. The size_add function parameters are of size_t, so
64b data types may be truncated when cast to size_t on 32b
systems. When using check_add_overflow, no type casts are made,
making it a more portable option.

Signed-off-by: Zack McKevitt <zmckevit@qti.qualcomm.com>
Signed-off-by: Youssef Samir <youssef.abdulrahman@oss.qualcomm.com>
Reviewed-by: Jeff Hugo <jeff.hugo@oss.qualcomm.com>
Reviewed-by: Carl Vanderlip <carl.vanderlip@oss.qualcomm.com>
Signed-off-by: Jeff Hugo <jeff.hugo@oss.qualcomm.com>
Link: https://lore.kernel.org/r/20251015165408.213645-1-youssef.abdulrahman@oss.qualcomm.com

authored by

Zack McKevitt and committed by
Jeff Hugo 9cfe6abe 4e39740d

+11 -6
+11 -6
drivers/accel/qaic/sahara.c
··· 575 575 struct sahara_memory_dump_meta_v1 *dump_meta; 576 576 u64 table_nents; 577 577 u64 dump_length; 578 + u64 mul_bytes; 578 579 int ret; 579 580 u64 i; 580 581 ··· 589 588 dev_table[i].description[SAHARA_TABLE_ENTRY_STR_LEN - 1] = 0; 590 589 dev_table[i].filename[SAHARA_TABLE_ENTRY_STR_LEN - 1] = 0; 591 590 592 - dump_length = size_add(dump_length, le64_to_cpu(dev_table[i].length)); 593 - if (dump_length == SIZE_MAX) { 591 + if (check_add_overflow(dump_length, 592 + le64_to_cpu(dev_table[i].length), 593 + &dump_length)) { 594 594 /* Discard the dump */ 595 595 sahara_send_reset(context); 596 596 return; ··· 607 605 dev_table[i].filename); 608 606 } 609 607 610 - dump_length = size_add(dump_length, sizeof(*dump_meta)); 611 - if (dump_length == SIZE_MAX) { 608 + if (check_add_overflow(dump_length, (u64)sizeof(*dump_meta), &dump_length)) { 612 609 /* Discard the dump */ 613 610 sahara_send_reset(context); 614 611 return; 615 612 } 616 - dump_length = size_add(dump_length, size_mul(sizeof(*image_out_table), table_nents)); 617 - if (dump_length == SIZE_MAX) { 613 + if (check_mul_overflow((u64)sizeof(*image_out_table), table_nents, &mul_bytes)) { 614 + /* Discard the dump */ 615 + sahara_send_reset(context); 616 + return; 617 + } 618 + if (check_add_overflow(dump_length, mul_bytes, &dump_length)) { 618 619 /* Discard the dump */ 619 620 sahara_send_reset(context); 620 621 return;