diff options
| author |   Xiao Yang <yangx.jy@fujitsu.com> | 2021-08-20 19:15:09 +0800 |
|---|---|---|
| committer |   Jason Gunthorpe <jgg@nvidia.com> | 2021-08-20 15:48:58 -0300 |
| commit | cc4f596cf85e97ca6606e1bd10b3b9851ef52ddf (patch) | |
| tree | 926a27cccf0b31b81a774222e34362edaed3149d /drivers/infiniband/sw | |
| parent | RDMA/efa: Free IRQ vectors on error flow (diff) | |
| download | linux-dev-cc4f596cf85e97ca6606e1bd10b3b9851ef52ddf.tar.xz linux-dev-cc4f596cf85e97ca6606e1bd10b3b9851ef52ddf.zip | |
RDMA/rxe: Zero out index member of struct rxe_queue
1) New index member of struct rxe_queue was introduced but not zeroed so
the initial value of index may be random.
2) The current index is not masked off to index_mask.
In this case producer_addr() and consumer_addr() will get an invalid
address by the random index and then accessing the invalid address
triggers the following panic:
"BUG: unable to handle page fault for address: ffff9ae2c07a1414"
Fix the issue by using kzalloc() to zero out index member.
Fixes: 5bcf5a59c41e ("RDMA/rxe: Protext kernel index from user space")
Link: https://lore.kernel.org/r/20210820111509.172500-1-yangx.jy@fujitsu.com
Signed-off-by: Xiao Yang <yangx.jy@fujitsu.com>
Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
Diffstat (limited to 'drivers/infiniband/sw')
| -rw-r--r-- | drivers/infiniband/sw/rxe/rxe_queue.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/drivers/infiniband/sw/rxe/rxe_queue.c b/drivers/infiniband/sw/rxe/rxe_queue.c index 85b812586ed4..72d95398e604 100644 --- a/drivers/infiniband/sw/rxe/rxe_queue.c +++ b/drivers/infiniband/sw/rxe/rxe_queue.c @@ -63,7 +63,7 @@ struct rxe_queue *rxe_queue_init(struct rxe_dev *rxe, int *num_elem, if (*num_elem < 0) goto err1; - q = kmalloc(sizeof(*q), GFP_KERNEL); + q = kzalloc(sizeof(*q), GFP_KERNEL); if (!q) goto err1; |