From: Håkon Bugge haakon.bugge@oracle.com
commit 8d0d2b0f41b1b2add8a30dbd816051a964efa497 upstream.
The existing tests are a little hard to comprehend. Use check_add_overflow() instead.
Fixes: 04ded1672402 ("RDMA/cma: Verify private data length") Link: https://lore.kernel.org/r/1637661978-18770-1-git-send-email-haakon.bugge@ora... Signed-off-by: Håkon Bugge haakon.bugge@oracle.com Reviewed-by: Leon Romanovsky leonro@nvidia.com Signed-off-by: Jason Gunthorpe jgg@nvidia.com Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org --- drivers/infiniband/core/cma.c | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-)
--- a/drivers/infiniband/core/cma.c +++ b/drivers/infiniband/core/cma.c @@ -4037,8 +4037,7 @@ static int cma_resolve_ib_udp(struct rdm
memset(&req, 0, sizeof req); offset = cma_user_data_offset(id_priv); - req.private_data_len = offset + conn_param->private_data_len; - if (req.private_data_len < conn_param->private_data_len) + if (check_add_overflow(offset, conn_param->private_data_len, &req.private_data_len)) return -EINVAL;
if (req.private_data_len) { @@ -4097,8 +4096,7 @@ static int cma_connect_ib(struct rdma_id
memset(&req, 0, sizeof req); offset = cma_user_data_offset(id_priv); - req.private_data_len = offset + conn_param->private_data_len; - if (req.private_data_len < conn_param->private_data_len) + if (check_add_overflow(offset, conn_param->private_data_len, &req.private_data_len)) return -EINVAL;
if (req.private_data_len) {