[PATCH] accel/qaic: Replace user defined overflow check

[PATCH] accel/qaic: Replace user defined overflow check

[Youssef Samir]

From: Sourab Bera <quic_sourbera@quicinc.com>

Replace the current logic to check overflow, with the kernel-provided
macro `check_mul_overflow` in the function __qaic_execute_bo_ioctl().

Signed-off-by: Sourab Bera <quic_sourbera@quicinc.com>
Signed-off-by: Youssef Samir <youssef.abdulrahman@oss.qualcomm.com>
---
 drivers/accel/qaic/qaic_data.c | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/drivers/accel/qaic/qaic_data.c b/drivers/accel/qaic/qaic_data.c
index 797289e9d780..e6f96dbb3382 100644
--- a/drivers/accel/qaic/qaic_data.c
+++ b/drivers/accel/qaic/qaic_data.c
@@ -15,6 +15,7 @@
 #include <linux/math64.h>
 #include <linux/mm.h>
 #include <linux/moduleparam.h>
+#include <linux/overflow.h>
 #include <linux/scatterlist.h>
 #include <linux/spinlock.h>
 #include <linux/srcu.h>
@@ -1305,17 +1306,17 @@ static int __qaic_execute_bo_ioctl(struct drm_device *dev, void *data, struct dr
 	u64 received_ts;
 	u32 queue_level;
 	u64 submit_ts;
+	size_t size;
 	int rcu_id;
 	u32 head;
 	u32 tail;
-	u64 size;
 	int ret;
 
 	received_ts = ktime_get_ns();
 
 	size = is_partial ? sizeof(struct qaic_partial_execute_entry) : sizeof(*exec);
-	n = (unsigned long)size * args->hdr.count;
-	if (args->hdr.count == 0 || n / args->hdr.count != size)
+	if (args->hdr.count == 0 ||
+	    check_mul_overflow((unsigned long)size, (unsigned long)args->hdr.count, &n))
 		return -EINVAL;
 
 	user_data = u64_to_user_ptr(args->data);
-- 
2.43.0

Re: [PATCH] accel/qaic: Replace user defined overflow check

[Carl Vanderlip]

On 10/15/2025 8:22 AM, Youssef Samir wrote:
> From: Sourab Bera <quic_sourbera@quicinc.com>
> 
> Replace the current logic to check overflow, with the kernel-provided
> macro `check_mul_overflow` in the function __qaic_execute_bo_ioctl().
> 
> Signed-off-by: Sourab Bera <quic_sourbera@quicinc.com>
> Signed-off-by: Youssef Samir <youssef.abdulrahman@oss.qualcomm.com>
> ---

Reviewed-by: Carl Vanderlip <carl.vanderlip@oss.qualcomm.com>

Re: [PATCH] accel/qaic: Replace user defined overflow check

[Jeff Hugo]

On 10/15/2025 9:22 AM, Youssef Samir wrote:
> From: Sourab Bera <quic_sourbera@quicinc.com>
> 
> Replace the current logic to check overflow, with the kernel-provided
> macro `check_mul_overflow` in the function __qaic_execute_bo_ioctl().
> 
> Signed-off-by: Sourab Bera <quic_sourbera@quicinc.com>
> Signed-off-by: Youssef Samir <youssef.abdulrahman@oss.qualcomm.com>

Reviewed-by: Jeff Hugo <jeff.hugo@oss.qualcomm.com>

Re: [PATCH] accel/qaic: Replace user defined overflow check

[Falkowski, Maciej]

Reviewed-by: Maciej Falkowski <maciej.falkowski@linux.intel.com>

On 10/15/2025 5:22 PM, Youssef Samir wrote:
> From: Sourab Bera <quic_sourbera@quicinc.com>
>
> Replace the current logic to check overflow, with the kernel-provided
> macro `check_mul_overflow` in the function __qaic_execute_bo_ioctl().
>
> Signed-off-by: Sourab Bera <quic_sourbera@quicinc.com>
> Signed-off-by: Youssef Samir <youssef.abdulrahman@oss.qualcomm.com>
> ---
>   drivers/accel/qaic/qaic_data.c | 7 ++++---
>   1 file changed, 4 insertions(+), 3 deletions(-)
>
> diff --git a/drivers/accel/qaic/qaic_data.c b/drivers/accel/qaic/qaic_data.c
> index 797289e9d780..e6f96dbb3382 100644
> --- a/drivers/accel/qaic/qaic_data.c
> +++ b/drivers/accel/qaic/qaic_data.c
> @@ -15,6 +15,7 @@
>   #include <linux/math64.h>
>   #include <linux/mm.h>
>   #include <linux/moduleparam.h>
> +#include <linux/overflow.h>
>   #include <linux/scatterlist.h>
>   #include <linux/spinlock.h>
>   #include <linux/srcu.h>
> @@ -1305,17 +1306,17 @@ static int __qaic_execute_bo_ioctl(struct drm_device *dev, void *data, struct dr
>   	u64 received_ts;
>   	u32 queue_level;
>   	u64 submit_ts;
> +	size_t size;
>   	int rcu_id;
>   	u32 head;
>   	u32 tail;
> -	u64 size;
>   	int ret;
>   
>   	received_ts = ktime_get_ns();
>   
>   	size = is_partial ? sizeof(struct qaic_partial_execute_entry) : sizeof(*exec);
> -	n = (unsigned long)size * args->hdr.count;
> -	if (args->hdr.count == 0 || n / args->hdr.count != size)
> +	if (args->hdr.count == 0 ||
> +	    check_mul_overflow((unsigned long)size, (unsigned long)args->hdr.count, &n))
>   		return -EINVAL;
>   
>   	user_data = u64_to_user_ptr(args->data);

Re: [PATCH] accel/qaic: Replace user defined overflow check

[Jeff Hugo]

On 10/15/2025 9:22 AM, Youssef Samir wrote:
> From: Sourab Bera <quic_sourbera@quicinc.com>
> 
> Replace the current logic to check overflow, with the kernel-provided
> macro `check_mul_overflow` in the function __qaic_execute_bo_ioctl().
> 
> Signed-off-by: Sourab Bera <quic_sourbera@quicinc.com>
> Signed-off-by: Youssef Samir <youssef.abdulrahman@oss.qualcomm.com>

Youssef,

It looks like this conflicts with "accel/qaic: Replace kcalloc + 
copy_from_user with memdup_array_user".  It looks like we don't need to 
bring back the overflow check, which would make this change no longer 
needed.

Can you have a look and see if you agree?

-Jeff

Re: [PATCH] accel/qaic: Replace user defined overflow check

[Youssef Abdulrahman]

On Mon, Oct 20, 2025 at 4:05 PM Jeff Hugo <jeff.hugo@oss.qualcomm.com> wrote:
>
> On 10/15/2025 9:22 AM, Youssef Samir wrote:
> > From: Sourab Bera <quic_sourbera@quicinc.com>
> >
> > Replace the current logic to check overflow, with the kernel-provided
> > macro `check_mul_overflow` in the function __qaic_execute_bo_ioctl().
> >
> > Signed-off-by: Sourab Bera <quic_sourbera@quicinc.com>
> > Signed-off-by: Youssef Samir <youssef.abdulrahman@oss.qualcomm.com>
>
> Youssef,
>
> It looks like this conflicts with "accel/qaic: Replace kcalloc +
> copy_from_user with memdup_array_user".  It looks like we don't need to
> bring back the overflow check, which would make this change no longer
> needed.
>
> Can you have a look and see if you agree?
Hi Jeff,

I checked it out and you're right. It doesn't apply anymore.

-Youssef