提交 19ab574f 编写于 作者: M Matan Barak 提交者: David S. Miller

net/mlx4: Fix memory corruption in mlx4_MAD_IFC_wrapper

Fix a memory corruption at mlx4_MAD_IFC_wrapper.

A table of size dev->caps.pkey_table_len[port]*sizeof(*table)
was allocated, but get_full_pkey_table() assumes that the number
of entries in the table is a multiplication of 32 (which isn't always
correct).

Fixes: 0a9a0188 ('mlx4: MAD_IFC paravirtualization')
Signed-off-by: NMatan Barak <matanb@mellanox.com>
Signed-off-by: NOr Gerlitz <ogerlitz@mellanox.com>
Signed-off-by: NAmir Vadai <amirv@mellanox.com>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>
上级 5a228c03
...@@ -901,7 +901,9 @@ static int mlx4_MAD_IFC_wrapper(struct mlx4_dev *dev, int slave, ...@@ -901,7 +901,9 @@ static int mlx4_MAD_IFC_wrapper(struct mlx4_dev *dev, int slave,
index = be32_to_cpu(smp->attr_mod); index = be32_to_cpu(smp->attr_mod);
if (port < 1 || port > dev->caps.num_ports) if (port < 1 || port > dev->caps.num_ports)
return -EINVAL; return -EINVAL;
table = kcalloc(dev->caps.pkey_table_len[port], sizeof *table, GFP_KERNEL); table = kcalloc((dev->caps.pkey_table_len[port] / 32) + 1,
sizeof(*table) * 32, GFP_KERNEL);
if (!table) if (!table)
return -ENOMEM; return -ENOMEM;
/* need to get the full pkey table because the paravirtualized /* need to get the full pkey table because the paravirtualized
......
Markdown is supported
0% .
You are about to add 0 people to the discussion. Proceed with caution.
先完成此消息的编辑!
想要评论请 注册