diff options
| author |   Dan Carpenter <dan.carpenter@oracle.com> | 2020-05-19 18:45:25 +0300 |
|---|---|---|
| committer |   Jason Gunthorpe <jgg@mellanox.com> | 2020-05-19 20:40:21 -0300 |
| commit | bf1d8edb38bbf0628c1f2de7d13ab98533c1fe60 (patch) | |
| tree | 83d53f67f9ec70a02b4a60ebc1a6228aa3da060b /drivers/infiniband/ulp | |
| parent | RDMA/rtrs: Fix some signedness bugs in error handling (diff) | |
| download | linux-dev-bf1d8edb38bbf0628c1f2de7d13ab98533c1fe60.tar.xz linux-dev-bf1d8edb38bbf0628c1f2de7d13ab98533c1fe60.zip | |
RDMA/rtrs: Fix a couple off by one bugs in rtrs_srv_rdma_done()
These > comparisons should be >= to prevent accessing one element beyond
the end of the buffer.
Fixes: 9cb837480424 ("RDMA/rtrs: server: main functionality")
Link: https://lore.kernel.org/r/20200519154525.GA66801@mwanda
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Acked-by: Danil Kipnis <danil.kipnis@cloud.ionos.com>
Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
Diffstat (limited to 'drivers/infiniband/ulp')
| -rw-r--r-- | drivers/infiniband/ulp/rtrs/rtrs-srv.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/drivers/infiniband/ulp/rtrs/rtrs-srv.c b/drivers/infiniband/ulp/rtrs/rtrs-srv.c index eefd149ce7a4..863b3942e333 100644 --- a/drivers/infiniband/ulp/rtrs/rtrs-srv.c +++ b/drivers/infiniband/ulp/rtrs/rtrs-srv.c @@ -1213,8 +1213,8 @@ static void rtrs_srv_rdma_done(struct ib_cq *cq, struct ib_wc *wc) msg_id = imm_payload >> sess->mem_bits; off = imm_payload & ((1 << sess->mem_bits) - 1); - if (unlikely(msg_id > srv->queue_depth || - off > max_chunk_size)) { + if (unlikely(msg_id >= srv->queue_depth || + off >= max_chunk_size)) { rtrs_err(s, "Wrong msg_id %u, off %u\n", msg_id, off); close_sess(sess); |