From 6123f1fe53985645992b2ff648b3087b77b3ed16 Mon Sep 17 00:00:00 2001 From: Dan Carpenter Date: Wed, 21 Aug 2019 10:11:22 +0300 Subject: misc: xilinx_sdfec: Prevent integer overflow in xsdfec_table_write() The checking here needs to handle integer overflows because "offset" and "len" come from the user. Fixes: 20ec628e8007 ("misc: xilinx_sdfec: Add ability to configure LDPC") Signed-off-by: Dan Carpenter Reviewed-by: Michal Simek Reviewed-by: Dragan Cvetic Link: https://lore.kernel.org/r/20190821071122.GD26957@mwanda Signed-off-by: Greg Kroah-Hartman --- drivers/misc/xilinx_sdfec.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) (limited to 'drivers/misc/xilinx_sdfec.c') diff --git a/drivers/misc/xilinx_sdfec.c b/drivers/misc/xilinx_sdfec.c index 3fc53d20abf3..0bf3bcc8e1ef 100644 --- a/drivers/misc/xilinx_sdfec.c +++ b/drivers/misc/xilinx_sdfec.c @@ -611,7 +611,9 @@ static int xsdfec_table_write(struct xsdfec_dev *xsdfec, u32 offset, * Writes that go beyond the length of * Shared Scale(SC) table should fail */ - if ((XSDFEC_REG_WIDTH_JUMP * (offset + len)) > depth) { + if (offset > depth / XSDFEC_REG_WIDTH_JUMP || + len > depth / XSDFEC_REG_WIDTH_JUMP || + offset + len > depth / XSDFEC_REG_WIDTH_JUMP) { dev_dbg(xsdfec->dev, "Write exceeds SC table length"); return -EINVAL; } -- cgit v1.2.3