shinys000114/linux
1
0
Fork 0
mirror of https://github.com/hardkernel/linux.git synced 2026-06-04 02:02:28 +09:00
Code Issues Packages Projects Releases Wiki Activity

mlx4_core: Fix possible chunk sg list overflow in mlx4_alloc_icm()

Browse Source 
commit c0dc72bad9 upstream.

If the number of sg entries in the ICM chunk reaches MLX4_ICM_CHUNK_LEN,
we must set chunk to NULL even for coherent mappings so that the next
time through the loop will allocate another chunk.  Otherwise we'll
overflow the sg list the next time through the loop.  This will lead to
memory corruption if this case is hit.

mthca does not have this bug.

Signed-off-by: Sebastien Dugue <sebastien.dugue@bull.net>
Signed-off-by: Roland Dreier <rolandd@cisco.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
This commit is contained in:
Sebastien Dugue
2010-05-20 15:58:22 -07:00
committed by Greg Kroah-Hartman
parent da7d96769c
commit 00428967a0
1 changed files with 3 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
drivers/net/mlx4/icm.c
View File

@@ -175,10 +175,11 @@ struct mlx4_icm *mlx4_alloc_icm(struct mlx4_dev *dev, int npages,
if (chunk->nsg <= 0)
goto fail;
chunk = NULL;
}
if (chunk->npages == MLX4_ICM_CHUNK_LEN)
chunk = NULL;
npages -= 1 << cur_order;
} else {
--cur_order;