mirrors/linux
1
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git synced 2026-04-29 14:05:05 -04:00
Code Issues Packages Projects Releases Wiki Activity

RDMA/hns: Fix memory corruption when allocating XRCDN

Browse Source 
It's incorrect to cast the type of pointer to xrcdn from (u32 *) to
(unsigned long *), then pass it into hns_roce_bitmap_alloc(), this will
lead to a memory corruption.

Fixes: 32548870d4 ("RDMA/hns: Add support for XRC on HIP09")
Link: https://lore.kernel.org/r/1616381069-51759-1-git-send-email-liweihang@huawei.com
Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Weihang Li <liweihang@huawei.com>
Reviewed-by: Leon Romanovsky <leonro@nvidia.com>
Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
This commit is contained in:
Weihang Li
2021-03-22 10:44:29 +08:00
committed by Jason Gunthorpe
parent e1ce4de680
commit 783cf673b0
1 changed files with 10 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

12
drivers/infiniband/hw/hns/hns_roce_pd.c
View File

@@ -140,8 +140,16 @@ void hns_roce_cleanup_uar_table(struct hns_roce_dev *hr_dev)
static int hns_roce_xrcd_alloc(struct hns_roce_dev *hr_dev, u32 *xrcdn)
{
return hns_roce_bitmap_alloc(&hr_dev->xrcd_bitmap,
(unsigned long *)xrcdn);
unsigned long obj;
int ret;
ret = hns_roce_bitmap_alloc(&hr_dev->xrcd_bitmap, &obj);
if (ret)
return ret;
*xrcdn = obj;
return 0;
}
static void hns_roce_xrcd_free(struct hns_roce_dev *hr_dev,