Home Home > GIT Browse > SLE12-SP3-AZURE
summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorDenis Kirjanov <dkirjanov@suse.com>2019-02-13 11:00:09 +0100
committerDenis Kirjanov <dkirjanov@suse.com>2019-02-13 11:00:09 +0100
commit0ce2b4fa5681f932e6c60e29b68c31794fc0c7b4 (patch)
treed0ba02cff5aaa8833ae89914053ce6905f7c79c5
parent6debd5c99d25df245d32afe899dc4e8d24ce277e (diff)
RDMA/bnxt_re: Fix a couple off by one bugs (bsc#1020413,
-rw-r--r--patches.drivers/RDMA-bnxt_re-Fix-a-couple-off-by-one-bugs.patch45
-rw-r--r--series.conf1
2 files changed, 46 insertions, 0 deletions
diff --git a/patches.drivers/RDMA-bnxt_re-Fix-a-couple-off-by-one-bugs.patch b/patches.drivers/RDMA-bnxt_re-Fix-a-couple-off-by-one-bugs.patch
new file mode 100644
index 0000000000..0610ab3053
--- /dev/null
+++ b/patches.drivers/RDMA-bnxt_re-Fix-a-couple-off-by-one-bugs.patch
@@ -0,0 +1,45 @@
+From: Dan Carpenter <dan.carpenter@oracle.com>
+Date: Wed, 4 Jul 2018 12:57:11 +0300
+Subject: RDMA/bnxt_re: Fix a couple off by one bugs
+Patch-mainline: v4.19-rc1
+Git-commit: 474e5a86067e5f12c97d1db8b170c7f45b53097a
+References: bsc#1020413, FATE#321905
+
+The sgid_tbl->tbl[] array is allocated in bnxt_qplib_alloc_sgid_tbl().
+It has sgid_tbl->max elements. So the > should be >= to prevent
+accessing one element beyond the end of the array.
+
+Fixes: 1ac5a4047975 ("RDMA/bnxt_re: Add bnxt_re RoCE driver")
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Acked-by: Selvin Xavier <selvin.xavier@broadcom.com>
+Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
+Acked-by: Denis Kirjanov <dkirjanov@suse.com>
+---
+ drivers/infiniband/hw/bnxt_re/qplib_sp.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/infiniband/hw/bnxt_re/qplib_sp.c b/drivers/infiniband/hw/bnxt_re/qplib_sp.c
+index 2f3f32eaa1d5..4097f3fa25c5 100644
+--- a/drivers/infiniband/hw/bnxt_re/qplib_sp.c
++++ b/drivers/infiniband/hw/bnxt_re/qplib_sp.c
+@@ -197,7 +197,7 @@ int bnxt_qplib_get_sgid(struct bnxt_qplib_res *res,
+ struct bnxt_qplib_sgid_tbl *sgid_tbl, int index,
+ struct bnxt_qplib_gid *gid)
+ {
+- if (index > sgid_tbl->max) {
++ if (index >= sgid_tbl->max) {
+ dev_err(&res->pdev->dev,
+ "QPLIB: Index %d exceeded SGID table max (%d)",
+ index, sgid_tbl->max);
+@@ -402,7 +402,7 @@ int bnxt_qplib_get_pkey(struct bnxt_qplib_res *res,
+ *pkey = 0xFFFF;
+ return 0;
+ }
+- if (index > pkey_tbl->max) {
++ if (index >= pkey_tbl->max) {
+ dev_err(&res->pdev->dev,
+ "QPLIB: Index %d exceeded PKEY table max (%d)",
+ index, pkey_tbl->max);
+--
+2.12.3
+
diff --git a/series.conf b/series.conf
index f4a8e40c64..02e9882a1a 100644
--- a/series.conf
+++ b/series.conf
@@ -24256,6 +24256,7 @@
patches.arch/kvm-nvmx-unconditionally-cancel-preemption-timer-in-free_nested-cve-2019-7221
patches.fixes/0001-drm-vmwgfx-Return-error-code-from-vmw_execbuf_copy_f.patch
patches.fixes/0001-drm-vmwgfx-Fix-setting-of-dma-masks.patch
+ patches.drivers/RDMA-bnxt_re-Fix-a-couple-off-by-one-bugs.patch
# mkp/scsi 5.0/scsi-fixes
patches.fixes/scsi-target-make-the-pi_prot_format-ConfigFS-path-re.patch