MIRRORS/linux-imx
1
0
Fork 0
mirror of https://github.com/nxp-imx/linux-imx.git synced 2025-07-07 09:55:19 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity

RDMA/rtrs-clt: Reset cid to con_num - 1 to stay in bounds

Browse Source 
[ Upstream commit 3e4289b29e ]

In the function init_conns(), after the create_con() and create_cm() for
loop if something fails. In the cleanup for loop after the destroy tag, we
access out of bound memory because cid is set to clt_path->s.con_num.

This commits resets the cid to clt_path->s.con_num - 1, to stay in bounds
in the cleanup loop later.

Fixes: 6a98d71dae ("RDMA/rtrs: client: main functionality")
Signed-off-by: Md Haris Iqbal <haris.iqbal@ionos.com>
Signed-off-by: Jack Wang <jinpu.wang@ionos.com>
Signed-off-by: Grzegorz Prajsner <grzegorz.prajsner@ionos.com>
Link: https://patch.msgid.link/20240821112217.41827-7-haris.iqbal@ionos.com
Signed-off-by: Leon Romanovsky <leon@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
This commit is contained in:
Md Haris Iqbal 2024-08-21 13:22:12 +02:00 committed by Greg Kroah-Hartman
parent effc10f00c
commit 01b9be936e
1 changed files with 6 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
drivers/infiniband/ulp/rtrs/rtrs-clt.c
View File

@ -2342,6 +2342,12 @@ static int init_conns(struct rtrs_clt_path *clt_path)
if (err) if (err)
goto destroy; goto destroy;
} }
/*
* Set the cid to con_num - 1, since if we fail later, we want to stay in bounds.
*/
cid = clt_path->s.con_num - 1;
err = alloc_path_reqs(clt_path); err = alloc_path_reqs(clt_path);
if (err) if (err)
goto destroy; goto destroy;