| From 3598293b77540064eb963183aac2eaae3d8274b6 Mon Sep 17 00:00:00 2001 |
| From: Sasha Levin <sashal@kernel.org> |
| Date: Thu, 12 Aug 2021 21:21:10 +0100 |
| Subject: crypto: qat - use proper type for vf_mask |
| |
| From: Giovanni Cabiddu <giovanni.cabiddu@intel.com> |
| |
| [ Upstream commit 462354d986b6a89c6449b85f17aaacf44e455216 ] |
| |
| Replace vf_mask type with unsigned long to avoid a stack-out-of-bound. |
| |
| This is to fix the following warning reported by KASAN the first time |
| adf_msix_isr_ae() gets called. |
| |
| [ 692.091987] BUG: KASAN: stack-out-of-bounds in find_first_bit+0x28/0x50 |
| [ 692.092017] Read of size 8 at addr ffff88afdf789e60 by task swapper/32/0 |
| [ 692.092076] Call Trace: |
| [ 692.092089] <IRQ> |
| [ 692.092101] dump_stack+0x9c/0xcf |
| [ 692.092132] print_address_description.constprop.0+0x18/0x130 |
| [ 692.092164] ? find_first_bit+0x28/0x50 |
| [ 692.092185] kasan_report.cold+0x7f/0x111 |
| [ 692.092213] ? static_obj+0x10/0x80 |
| [ 692.092234] ? find_first_bit+0x28/0x50 |
| [ 692.092262] find_first_bit+0x28/0x50 |
| [ 692.092288] adf_msix_isr_ae+0x16e/0x230 [intel_qat] |
| |
| Fixes: ed8ccaef52fa ("crypto: qat - Add support for SRIOV") |
| Signed-off-by: Giovanni Cabiddu <giovanni.cabiddu@intel.com> |
| Reviewed-by: Marco Chiappero <marco.chiappero@intel.com> |
| Reviewed-by: Fiona Trahe <fiona.trahe@intel.com> |
| Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au> |
| Signed-off-by: Sasha Levin <sashal@kernel.org> |
| --- |
| drivers/crypto/qat/qat_common/adf_isr.c | 7 ++++--- |
| 1 file changed, 4 insertions(+), 3 deletions(-) |
| |
| diff --git a/drivers/crypto/qat/qat_common/adf_isr.c b/drivers/crypto/qat/qat_common/adf_isr.c |
| index e3ad5587be49..daab02011717 100644 |
| --- a/drivers/crypto/qat/qat_common/adf_isr.c |
| +++ b/drivers/crypto/qat/qat_common/adf_isr.c |
| @@ -15,6 +15,8 @@ |
| #include "adf_transport_access_macros.h" |
| #include "adf_transport_internal.h" |
| |
| +#define ADF_MAX_NUM_VFS 32 |
| + |
| static int adf_enable_msix(struct adf_accel_dev *accel_dev) |
| { |
| struct adf_accel_pci *pci_dev_info = &accel_dev->accel_pci_dev; |
| @@ -72,7 +74,7 @@ static irqreturn_t adf_msix_isr_ae(int irq, void *dev_ptr) |
| struct adf_bar *pmisc = |
| &GET_BARS(accel_dev)[hw_data->get_misc_bar_id(hw_data)]; |
| void __iomem *pmisc_bar_addr = pmisc->virt_addr; |
| - u32 vf_mask; |
| + unsigned long vf_mask; |
| |
| /* Get the interrupt sources triggered by VFs */ |
| vf_mask = ((ADF_CSR_RD(pmisc_bar_addr, ADF_ERRSOU5) & |
| @@ -93,8 +95,7 @@ static irqreturn_t adf_msix_isr_ae(int irq, void *dev_ptr) |
| * unless the VF is malicious and is attempting to |
| * flood the host OS with VF2PF interrupts. |
| */ |
| - for_each_set_bit(i, (const unsigned long *)&vf_mask, |
| - (sizeof(vf_mask) * BITS_PER_BYTE)) { |
| + for_each_set_bit(i, &vf_mask, ADF_MAX_NUM_VFS) { |
| vf_info = accel_dev->pf.vf_info + i; |
| |
| if (!__ratelimit(&vf_info->vf2pf_ratelimit)) { |
| -- |
| 2.30.2 |
| |