xen/grants: prevent integer overflow in gnttab_dma_alloc_pages()

The change from kcalloc() to kvmalloc() means that arg->nr_pages might now be large enough that the "args->nr_pages << PAGE_SHIFT" can result in an integer overflow.

Dan Carpenter committed 4 years ago

Commit e9ea0b31 parent fe8f65b1 file · +3 −0Browse files

Unified · Split

drivers/xen/grant-table.c+3−0

@@ -1047,6 +1047,9 @@ int gnttab_dma_alloc_pages(struct gnttab_dma_alloc_args *args) · 1046 unmodified lines
1047	size_t size;	1047	size_t size;
1048	int i, ret;	1048	int i, ret;
1049		1049
		1050	if (args->nr_pages < 0 \|\| args->nr_pages > (INT_MAX >> PAGE_SHIFT))
		1051	return -ENOMEM;
		1052
1050	size = args->nr_pages << PAGE_SHIFT;	1053	size = args->nr_pages << PAGE_SHIFT;
1051	if (args->coherent)	1054	if (args->coherent)
1052	args->vaddr = dma_alloc_coherent(args->dev, size,	1055	args->vaddr = dma_alloc_coherent(args->dev, size,