xen/grants: prevent integer overflow in gnttab_dma_alloc_pages()

The change from kcalloc() to kvmalloc() means that arg->nr_pages might now be large enough that the "args->nr_pages << PAGE_SHIFT" can result in an integer overflow.

Dan Carpenter committed 4 years ago

Commit e9ea0b31 parent fe8f65b1 file · +3 −0Browse files

Unified · Split

drivers/xen/grant-table.c+3−0

@@ -1047,6 +1047,9 @@ int gnttab_dma_alloc_pages(struct gnttab_dma_alloc_args *args) · 1046 unmodified lines
1047	1047	size_t size;
1048	1048	int i, ret;
1049	1049
	1050	+ if (args->nr_pages < 0 \|\| args->nr_pages > (INT_MAX >> PAGE_SHIFT))
	1051	+ return -ENOMEM;
	1052	+
1050	1053	size = args->nr_pages << PAGE_SHIFT;
1051	1054	if (args->coherent)
1052	1055	args->vaddr = dma_alloc_coherent(args->dev, size,