diff options
| author | Roland Dreier <rolandd@cisco.com> | 2008-04-17 06:01:13 +0200 |
|---|---|---|
| committer | Roland Dreier <rolandd@cisco.com> | 2008-04-17 06:01:13 +0200 |
| commit | c263ff65d5936113cfcbb8139d34122361e2306e (patch) | |
| tree | 43d10528af61437b8dba0461f3d75639da3a2dad /drivers/infiniband/hw/mthca | |
| parent | IB/mthca: Avoid integer overflow when dealing with profile size (diff) | |
| download | linux-c263ff65d5936113cfcbb8139d34122361e2306e.tar.xz linux-c263ff65d5936113cfcbb8139d34122361e2306e.zip | |
IB/mthca: Avoid integer overflow when allocating huge ICM table
In mthca_alloc_icm_table(), the number of entries to allocate for the
table->icm array is computed by calculating obj_size * nobj and then
dividing by MTHCA_TABLE_CHUNK_SIZE. If nobj is really large, then
obj_size * nobj may overflow and the division may get the wrong value
(even a negative value). Fix this by calculating the number of
objects per chunk and then dividing nobj by this value instead.
This patch allows crazy configurations such as loading ib_mthca with
the module parameter num_mtt=33554432 to work properly.
Signed-off-by: Roland Dreier <rolandd@cisco.com>
Diffstat (limited to 'drivers/infiniband/hw/mthca')
| -rw-r--r-- | drivers/infiniband/hw/mthca/mthca_memfree.c | 4 |
1 files changed, 3 insertions, 1 deletions
diff --git a/drivers/infiniband/hw/mthca/mthca_memfree.c b/drivers/infiniband/hw/mthca/mthca_memfree.c index d7d502dd741e..b224079d4e1f 100644 --- a/drivers/infiniband/hw/mthca/mthca_memfree.c +++ b/drivers/infiniband/hw/mthca/mthca_memfree.c @@ -359,12 +359,14 @@ struct mthca_icm_table *mthca_alloc_icm_table(struct mthca_dev *dev, int use_lowmem, int use_coherent) { struct mthca_icm_table *table; + int obj_per_chunk; int num_icm; unsigned chunk_size; int i; u8 status; - num_icm = (obj_size * nobj + MTHCA_TABLE_CHUNK_SIZE - 1) / MTHCA_TABLE_CHUNK_SIZE; + obj_per_chunk = MTHCA_TABLE_CHUNK_SIZE / obj_size; + num_icm = DIV_ROUND_UP(nobj, obj_per_chunk); table = kmalloc(sizeof *table + num_icm * sizeof *table->icm, GFP_KERNEL); if (!table) |