tjh.dev / kernel
Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux
1
fork

Configure Feed

Select the types of activity you want to include in your feed.

RDMA/hns: Fix memory corruption when allocating XRCDN

It's incorrect to cast the type of pointer to xrcdn from (u32 *) to
(unsigned long *), then pass it into hns_roce_bitmap_alloc(), this will
lead to a memory corruption.

Fixes: 32548870d438 ("RDMA/hns: Add support for XRC on HIP09")
Link: https://lore.kernel.org/r/1616381069-51759-1-git-send-email-liweihang@huawei.com
Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Weihang Li <liweihang@huawei.com>
Reviewed-by: Leon Romanovsky <leonro@nvidia.com>
Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>

authored by

Weihang Li and committed by
Jason Gunthorpe 783cf673 e1ce4de6

+10 -2
+10 -2
drivers/infiniband/hw/hns/hns_roce_pd.c
··· 140 140 141 141 static int hns_roce_xrcd_alloc(struct hns_roce_dev *hr_dev, u32 *xrcdn) 142 142 { 143 - return hns_roce_bitmap_alloc(&hr_dev->xrcd_bitmap, 144 - (unsigned long *)xrcdn); 143 + unsigned long obj; 144 + int ret; 145 + 146 + ret = hns_roce_bitmap_alloc(&hr_dev->xrcd_bitmap, &obj); 147 + if (ret) 148 + return ret; 149 + 150 + *xrcdn = obj; 151 + 152 + return 0; 145 153 } 146 154 147 155 static void hns_roce_xrcd_free(struct hns_roce_dev *hr_dev,