hulk inclusion category: bugfix bugzilla: https://atomgit.com/openeuler/kernel/issues/10302 -------------------------------- pci_p2pdma_add_resource() validates the requested resource size with if (size + offset > pci_resource_len(pdev, bar)) Both size and offset are 64-bit unsigned values, so the addition can wrap. A provider that passes a size close to U64_MAX can make the sum small enough to pass the check, and the following range calculation pgmap->range.end = pgmap->range.start + size - 1; also wraps, handing devm_memremap_pages() an out-of-range resource. Use the subtraction form instead. The preceding check rejects offset >= pci_resource_len(), so the subtraction cannot underflow, and for every non-overflowing input the two forms are equivalent. Current callers clamp the size before calling, so this is defensive; the interface is exported and may be used by future providers. Fixes: 52916982af48 ("PCI/P2PDMA: Support peer-to-peer memory") Signed-off-by: Zizhi Wo <wozizhi@huawei.com> --- drivers/pci/p2pdma.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/pci/p2pdma.c b/drivers/pci/p2pdma.c index 8d9dce967a4c..00bfdac9c44c 100644 --- a/drivers/pci/p2pdma.c +++ b/drivers/pci/p2pdma.c @@ -359,11 +359,11 @@ int pci_p2pdma_add_resource_aligned(struct pci_dev *pdev, int bar, size_t size, return -EINVAL; if (!size) size = pci_resource_len(pdev, bar) - offset; - if (size + offset > pci_resource_len(pdev, bar)) + if (size > pci_resource_len(pdev, bar) - offset) return -EINVAL; error = pci_p2pdma_check_pagemap_align(pdev, bar, size, align, offset); if (error) return error; -- 2.52.0