kernel/linux
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ synced 2026-10-22 19:14:51 +00:00
Code Issues Releases Packages Activity
linux/drivers/vfio
History
Artem Sadovnikov 0e9c464c5b vfio/mlx5: fix possible overflow in tracking max message size 
[ Upstream commit b306019848 ]

MLX cap pg_track_log_max_msg_size consists of 5 bits, value of which is
used as power of 2 for max_msg_size. This can lead to multiplication
overflow between max_msg_size (u32) and integer constant, and afterwards
incorrect value is being written to rq_size.

Fix this issue by extending integer constant to u64 type.

Found by Linux Verification Center (linuxtesting.org) with SVACE.

Suggested-by: Alex Williamson <alex.williamson@redhat.com>
Signed-off-by: Artem Sadovnikov <a.sadovnikov@ispras.ru>
Reviewed-by: Yishai Hadas <yishaih@nvidia.com>
Link: https://lore.kernel.org/r/20250701144017.2410-2-a.sadovnikov@ispras.ru
Signed-off-by: Alex Williamson <alex.williamson@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
History 2025-08-28 16:26:02 +02:00
..
fsl-mc vfio/fsl-mc: Block calling interrupt handler without trigger 2024-04-03 15:19:47 +02:00
mdev vfio/mdev: Fix a null-ptr-deref bug for mdev_unregister_parent() 2023-10-06 14:56:45 +02:00
pci vfio/mlx5: fix possible overflow in tracking max message size 2025-08-28 16:26:02 +02:00
platform vfio/platform: check the bounds of read/write syscalls 2025-02-21 13:49:50 +01:00
container.c vfio: Use GFP_KERNEL_ACCOUNT for userspace persistent allocations 2024-04-03 15:19:34 +02:00
iova_bitmap.c iommufd/iova_bitmap: Fix shift-out-of-bounds in iova_bitmap_offset_to_index() 2025-02-21 13:49:17 +01:00
Kconfig vfio: Introduce the DMA logging feature support 2022-09-08 12:59:00 -06:00
Makefile vfio: Move container code into drivers/vfio/container.c 2022-09-22 15:46:06 -06:00
vfio.h vfio: Make the group FD disassociate from the iommu_group 2022-10-07 08:10:52 -06:00
vfio_iommu_spapr_tce.c vfio/spapr_tce: Fix the comment 2022-07-22 16:24:47 -06:00
vfio_iommu_type1.c vfio/type1: conditional rescheduling while pinning 2025-08-28 16:26:02 +02:00
vfio_main.c vfio: Export the device set open count 2022-11-10 12:03:36 -07:00
vfio_spapr_eeh.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 500 2019-06-19 17:09:55 +02:00
virqfd.c vfio: Introduce interface to flush virqfd inject workqueue 2024-04-03 15:19:46 +02:00