diff options
| author | Weihang Li <[email protected]> | 2021-03-22 10:44:29 +0800 |
|---|---|---|
| committer | Jason Gunthorpe <[email protected]> | 2021-03-22 21:46:37 -0300 |
| commit | 783cf673b05ebf290317f583ee7eb6967ed9c964 (patch) | |
| tree | 1bc353c050e00b4a9c2fc4773a14b86d09f37990 | |
| parent | e1ce4de68054847326f1f220e163b881736cce69 (diff) | |
RDMA/hns: Fix memory corruption when allocating XRCDN
It's incorrect to cast the type of pointer to xrcdn from (u32 *) to
(unsigned long *), then pass it into hns_roce_bitmap_alloc(), this will
lead to a memory corruption.
Fixes: 32548870d438 ("RDMA/hns: Add support for XRC on HIP09")
Link: https://lore.kernel.org/r/[email protected]
Reported-by: Dan Carpenter <[email protected]>
Signed-off-by: Weihang Li <[email protected]>
Reviewed-by: Leon Romanovsky <[email protected]>
Signed-off-by: Jason Gunthorpe <[email protected]>
| -rw-r--r-- | drivers/infiniband/hw/hns/hns_roce_pd.c | 12 |
1 files changed, 10 insertions, 2 deletions
diff --git a/drivers/infiniband/hw/hns/hns_roce_pd.c b/drivers/infiniband/hw/hns/hns_roce_pd.c index 3ca51ce1813a..a5813bf567b2 100644 --- a/drivers/infiniband/hw/hns/hns_roce_pd.c +++ b/drivers/infiniband/hw/hns/hns_roce_pd.c @@ -140,8 +140,16 @@ void hns_roce_cleanup_uar_table(struct hns_roce_dev *hr_dev) static int hns_roce_xrcd_alloc(struct hns_roce_dev *hr_dev, u32 *xrcdn) { - return hns_roce_bitmap_alloc(&hr_dev->xrcd_bitmap, - (unsigned long *)xrcdn); + unsigned long obj; + int ret; + + ret = hns_roce_bitmap_alloc(&hr_dev->xrcd_bitmap, &obj); + if (ret) + return ret; + + *xrcdn = obj; + + return 0; } static void hns_roce_xrcd_free(struct hns_roce_dev *hr_dev, |