diff options
| author | Dan Carpenter <dan.carpenter@linaro.org> | 2024-09-12 10:49:10 +0200 |
|---|---|---|
| committer | Alex Williamson <alex.williamson@redhat.com> | 2024-09-12 22:15:07 +0200 |
| commit | aab439ffa1ca1067c0114773d4044828fab582af (patch) | |
| tree | 58f3212ccc43db8bd46160a18e631beaedbbdeb8 /drivers/vfio | |
| parent | vfio/mdev: Constify struct kobj_type (diff) | |
| download | linux-aab439ffa1ca1067c0114773d4044828fab582af.tar.xz linux-aab439ffa1ca1067c0114773d4044828fab582af.zip | |
vfio/pci: clean up a type in vfio_pci_ioctl_pci_hot_reset_groups()
The "array_count" value comes from the copy_from_user() in
vfio_pci_ioctl_pci_hot_reset(). If the user passes a value larger than
INT_MAX then we'll pass a negative value to kcalloc() which triggers an
allocation failure and a stack trace.
It's better to make the type unsigned so that if (array_count > count)
returns -EINVAL instead.
Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org>
Reviewed-by: Jason Gunthorpe <jgg@nvidia.com>
Link: https://lore.kernel.org/r/262ada03-d848-4369-9c37-81edeeed2da2@stanley.mountain
Signed-off-by: Alex Williamson <alex.williamson@redhat.com>
Diffstat (limited to 'drivers/vfio')
| -rw-r--r-- | drivers/vfio/pci/vfio_pci_core.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/drivers/vfio/pci/vfio_pci_core.c b/drivers/vfio/pci/vfio_pci_core.c index 2127b82d301a..8343f802cf93 100644 --- a/drivers/vfio/pci/vfio_pci_core.c +++ b/drivers/vfio/pci/vfio_pci_core.c @@ -1323,7 +1323,7 @@ out: static int vfio_pci_ioctl_pci_hot_reset_groups(struct vfio_pci_core_device *vdev, - int array_count, bool slot, + u32 array_count, bool slot, struct vfio_pci_hot_reset __user *arg) { int32_t *group_fds; |