@@ -332,6 +332,17 @@ static bool pci_endpoint_test_msi_irq(struct pci_endpoint_test *test,
332
332
return false;
333
333
}
334
334
335
+ static int pci_endpoint_test_validate_xfer_params (struct device * dev ,
336
+ struct pci_endpoint_test_xfer_param * param , size_t alignment )
337
+ {
338
+ if (param -> size > SIZE_MAX - alignment ) {
339
+ dev_dbg (dev , "Maximum transfer data size exceeded\n" );
340
+ return - EINVAL ;
341
+ }
342
+
343
+ return 0 ;
344
+ }
345
+
335
346
static bool pci_endpoint_test_copy (struct pci_endpoint_test * test ,
336
347
unsigned long arg )
337
348
{
@@ -363,9 +374,11 @@ static bool pci_endpoint_test_copy(struct pci_endpoint_test *test,
363
374
return false;
364
375
}
365
376
377
+ err = pci_endpoint_test_validate_xfer_params (dev , & param , alignment );
378
+ if (err )
379
+ return false;
380
+
366
381
size = param .size ;
367
- if (size > SIZE_MAX - alignment )
368
- goto err ;
369
382
370
383
use_dma = !!(param .flags & PCITEST_FLAGS_USE_DMA );
371
384
if (use_dma )
@@ -497,9 +510,11 @@ static bool pci_endpoint_test_write(struct pci_endpoint_test *test,
497
510
return false;
498
511
}
499
512
513
+ err = pci_endpoint_test_validate_xfer_params (dev , & param , alignment );
514
+ if (err )
515
+ return false;
516
+
500
517
size = param .size ;
501
- if (size > SIZE_MAX - alignment )
502
- goto err ;
503
518
504
519
use_dma = !!(param .flags & PCITEST_FLAGS_USE_DMA );
505
520
if (use_dma )
@@ -595,9 +610,11 @@ static bool pci_endpoint_test_read(struct pci_endpoint_test *test,
595
610
return false;
596
611
}
597
612
613
+ err = pci_endpoint_test_validate_xfer_params (dev , & param , alignment );
614
+ if (err )
615
+ return false;
616
+
598
617
size = param .size ;
599
- if (size > SIZE_MAX - alignment )
600
- goto err ;
601
618
602
619
use_dma = !!(param .flags & PCITEST_FLAGS_USE_DMA );
603
620
if (use_dma )
0 commit comments