| Message ID | 1616143536-24874-1-git-send-email-liweihang@huawei.com (mailing list archive) |
|---|---|
| State | Superseded |
| Headers | show |
| Series | [for-next] RDMA/hns: Fix memory corruption when allocating XRCDN | expand |
On Fri, Mar 19, 2021 at 04:45:36PM +0800, Weihang Li wrote: > It's incorrect to cast the type of pointer to xrcdn from (u32 *) to > (unsigned long *), then pass it into hns_roce_bitmap_alloc(), this will > lead to a memory corruption. > > Fixes: 32548870d438 ("RDMA/hns: Add support for XRC on HIP09") > Reported-by: Dan Carpenter <dan.carpenter@oracle.com> > Signed-off-by: Weihang Li <liweihang@huawei.com> > --- > drivers/infiniband/hw/hns/hns_roce_pd.c | 10 ++++++++-- > 1 file changed, 8 insertions(+), 2 deletions(-) > > diff --git a/drivers/infiniband/hw/hns/hns_roce_pd.c b/drivers/infiniband/hw/hns/hns_roce_pd.c > index 3ca51ce..16d6b69 100644 > --- a/drivers/infiniband/hw/hns/hns_roce_pd.c > +++ b/drivers/infiniband/hw/hns/hns_roce_pd.c > @@ -140,8 +140,14 @@ void hns_roce_cleanup_uar_table(struct hns_roce_dev *hr_dev) > > static int hns_roce_xrcd_alloc(struct hns_roce_dev *hr_dev, u32 *xrcdn) > { > - return hns_roce_bitmap_alloc(&hr_dev->xrcd_bitmap, > - (unsigned long *)xrcdn); > + unsigned long obj; > + int ret; > + > + ret = hns_roce_bitmap_alloc(&hr_dev->xrcd_bitmap, &obj); > + > + *xrcdn = (u32)obj; NIT, it will be safer if you don't set set xrcdn after hns_roce_bitmap_alloc() failed. Thanks > + > + return ret; > } > > static void hns_roce_xrcd_free(struct hns_roce_dev *hr_dev, > -- > 2.8.1 >
On 2021/3/20 17:33, Leon Romanovsky wrote: > On Fri, Mar 19, 2021 at 04:45:36PM +0800, Weihang Li wrote: >> It's incorrect to cast the type of pointer to xrcdn from (u32 *) to >> (unsigned long *), then pass it into hns_roce_bitmap_alloc(), this will >> lead to a memory corruption. >> >> Fixes: 32548870d438 ("RDMA/hns: Add support for XRC on HIP09") >> Reported-by: Dan Carpenter <dan.carpenter@oracle.com> >> Signed-off-by: Weihang Li <liweihang@huawei.com> >> --- >> drivers/infiniband/hw/hns/hns_roce_pd.c | 10 ++++++++-- >> 1 file changed, 8 insertions(+), 2 deletions(-) >> >> diff --git a/drivers/infiniband/hw/hns/hns_roce_pd.c b/drivers/infiniband/hw/hns/hns_roce_pd.c >> index 3ca51ce..16d6b69 100644 >> --- a/drivers/infiniband/hw/hns/hns_roce_pd.c >> +++ b/drivers/infiniband/hw/hns/hns_roce_pd.c >> @@ -140,8 +140,14 @@ void hns_roce_cleanup_uar_table(struct hns_roce_dev *hr_dev) >> >> static int hns_roce_xrcd_alloc(struct hns_roce_dev *hr_dev, u32 *xrcdn) >> { >> - return hns_roce_bitmap_alloc(&hr_dev->xrcd_bitmap, >> - (unsigned long *)xrcdn); >> + unsigned long obj; >> + int ret; >> + >> + ret = hns_roce_bitmap_alloc(&hr_dev->xrcd_bitmap, &obj); >> + >> + *xrcdn = (u32)obj; > > NIT, it will be safer if you don't set set xrcdn after hns_roce_bitmap_alloc() failed. > > Thanks > >> + >> + return ret; >> } >> >> static void hns_roce_xrcd_free(struct hns_roce_dev *hr_dev, >> -- >> 2.8.1 >> Thank you, I will fix it. Weihang
diff --git a/drivers/infiniband/hw/hns/hns_roce_pd.c b/drivers/infiniband/hw/hns/hns_roce_pd.c index 3ca51ce..16d6b69 100644 --- a/drivers/infiniband/hw/hns/hns_roce_pd.c +++ b/drivers/infiniband/hw/hns/hns_roce_pd.c @@ -140,8 +140,14 @@ void hns_roce_cleanup_uar_table(struct hns_roce_dev *hr_dev) static int hns_roce_xrcd_alloc(struct hns_roce_dev *hr_dev, u32 *xrcdn) { - return hns_roce_bitmap_alloc(&hr_dev->xrcd_bitmap, - (unsigned long *)xrcdn); + unsigned long obj; + int ret; + + ret = hns_roce_bitmap_alloc(&hr_dev->xrcd_bitmap, &obj); + + *xrcdn = (u32)obj; + + return ret; } static void hns_roce_xrcd_free(struct hns_roce_dev *hr_dev,
It's incorrect to cast the type of pointer to xrcdn from (u32 *) to (unsigned long *), then pass it into hns_roce_bitmap_alloc(), this will lead to a memory corruption. Fixes: 32548870d438 ("RDMA/hns: Add support for XRC on HIP09") Reported-by: Dan Carpenter <dan.carpenter@oracle.com> Signed-off-by: Weihang Li <liweihang@huawei.com> --- drivers/infiniband/hw/hns/hns_roce_pd.c | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-)