Commit 11f08c30 authored by Youssef Samir's avatar Youssef Samir Committed by Jeff Hugo
Browse files

accel/qaic: Treat remaining == 0 as error in find_and_map_user_pages() 



Currently, if find_and_map_user_pages() takes a DMA xfer request from the
user with a length field set to 0, or in a rare case, the host receives
QAIC_TRANS_DMA_XFER_CONT from the device where resources->xferred_dma_size
is equal to the requested transaction size, the function will return 0
before allocating an sgt or setting the fields of the dma_xfer struct.
In that case, encode_addr_size_pairs() will try to access the sgt which
will lead to a general protection fault.

Return an EINVAL in case the user provides a zero-sized ALP, or the device
requests continuation after all of the bytes have been transferred.

Fixes: 96d3c1ca ("accel/qaic: Clean up integer overflow checking in map_user_pages()")
Signed-off-by: default avatarYoussef Samir <quic_yabdulra@quicinc.com>
Signed-off-by: default avatarYoussef Samir <youssef.abdulrahman@oss.qualcomm.com>
Reviewed-by: default avatarJeff Hugo <jeff.hugo@oss.qualcomm.com>
Reviewed-by: default avatarCarl Vanderlip <carl.vanderlip@oss.qualcomm.com>
Signed-off-by: default avatarJeff Hugo <jeff.hugo@oss.qualcomm.com>
Link: https://lore.kernel.org/r/20251007122320.339654-1-youssef.abdulrahman@oss.qualcomm.com
parent fd6e3855

drivers/accel/qaic/qaic_control.c

+1 −1
Original line number Diff line number Diff line
@@ -407,7 +407,7 @@ static int find_and_map_user_pages(struct qaic_device *qdev, 
		return -EINVAL;

	remaining = in_trans->size - resources->xferred_dma_size;

	if (remaining == 0)

		return 0;

		return -EINVAL;



	if (check_add_overflow(xfer_start_addr, remaining, &end))

		return -EINVAL;