libnvdimm: fix integer overflow static analysis warning

[mirror_ubuntu-artful-kernel.git] / drivers / nvdimm / bus.c

diff --git a/drivers/nvdimm/bus.c b/drivers/nvdimm/bus.c
index 937fafa1886a8056f08ae809a129eb43f90daffd..54eb14c7ef90ef13146bd4076ec13bbbeb498eed 100644 (file)
--- a/drivers/nvdimm/bus.c
+++ b/drivers/nvdimm/bus.c
@@ -905,19 +905,20 @@ static int __nd_ioctl(struct nvdimm_bus *nvdimm_bus, struct nvdimm *nvdimm,
                int read_only, unsigned int ioctl_cmd, unsigned long arg)
 {
        struct nvdimm_bus_descriptor *nd_desc = nvdimm_bus->nd_desc;
-       size_t buf_len = 0, in_len = 0, out_len = 0;
        static char out_env[ND_CMD_MAX_ENVELOPE];
        static char in_env[ND_CMD_MAX_ENVELOPE];
        const struct nd_cmd_desc *desc = NULL;
        unsigned int cmd = _IOC_NR(ioctl_cmd);
-       unsigned int func = cmd;
-       void __user *p = (void __user *) arg;
        struct device *dev = &nvdimm_bus->dev;
-       struct nd_cmd_pkg pkg;
+       void __user *p = (void __user *) arg;
        const char *cmd_name, *dimm_name;
+       u32 in_len = 0, out_len = 0;
+       unsigned int func = cmd;
        unsigned long cmd_mask;
-       void *buf;
+       struct nd_cmd_pkg pkg;
        int rc, i, cmd_rc;
+       u64 buf_len = 0;
+       void *buf;
 
        if (nvdimm) {
                desc = nd_cmd_dimm_desc(cmd);
@@ -977,7 +978,7 @@ static int __nd_ioctl(struct nvdimm_bus *nvdimm_bus, struct nvdimm *nvdimm,
 
        if (cmd == ND_CMD_CALL) {
                func = pkg.nd_command;
-               dev_dbg(dev, "%s:%s, idx: %llu, in: %zu, out: %zu, len %zu\n",
+               dev_dbg(dev, "%s:%s, idx: %llu, in: %u, out: %u, len %llu\n",
                                __func__, dimm_name, pkg.nd_command,
                                in_len, out_len, buf_len);
 
@@ -1007,9 +1008,9 @@ static int __nd_ioctl(struct nvdimm_bus *nvdimm_bus, struct nvdimm *nvdimm,
                out_len += out_size;
        }
 
-       buf_len = out_len + in_len;
+       buf_len = (u64) out_len + (u64) in_len;
        if (buf_len > ND_IOCTL_MAX_BUFLEN) {
-               dev_dbg(dev, "%s:%s cmd: %s buf_len: %zu > %d\n", __func__,
+               dev_dbg(dev, "%s:%s cmd: %s buf_len: %llu > %d\n", __func__,
                                dimm_name, cmd_name, buf_len,
                                ND_IOCTL_MAX_BUFLEN);
                return -EINVAL;