diff options
| author | Daniil Dulov <d.dulov@aladdin.ru> | 2023-02-27 01:17:51 -0800 |
|---|---|---|
| committer | Leon Romanovsky <leon@kernel.org> | 2023-03-13 13:54:49 +0200 |
| commit | 271bfcfb83a9f77cbae3d6e1a16e3c14132922f0 (patch) | |
| tree | 3ac30bc7418f06219d43f30bc37bd9ba5b553723 /drivers/infiniband/sw/siw/siw_qp_tx.c | |
| parent | c874ad879c2f29ebe040a34b974389875c0d81eb (diff) | |
RDMA/siw: Fix potential page_array out of range access
When seg is equal to MAX_ARRAY, the loop should break, otherwise
it will result in out of range access.
Found by Linux Verification Center (linuxtesting.org) with SVACE.
Fixes: b9be6f18cf9e ("rdma/siw: transmit path")
Signed-off-by: Daniil Dulov <d.dulov@aladdin.ru>
Link: https://lore.kernel.org/r/20230227091751.589612-1-d.dulov@aladdin.ru
Signed-off-by: Leon Romanovsky <leon@kernel.org>
Diffstat (limited to 'drivers/infiniband/sw/siw/siw_qp_tx.c')
| -rw-r--r-- | drivers/infiniband/sw/siw/siw_qp_tx.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/drivers/infiniband/sw/siw/siw_qp_tx.c b/drivers/infiniband/sw/siw/siw_qp_tx.c index 05052b49107f..6bb9e9e81ff4 100644 --- a/drivers/infiniband/sw/siw/siw_qp_tx.c +++ b/drivers/infiniband/sw/siw/siw_qp_tx.c @@ -558,7 +558,7 @@ static int siw_tx_hdt(struct siw_iwarp_tx *c_tx, struct socket *s) data_len -= plen; fp_off = 0; - if (++seg > (int)MAX_ARRAY) { + if (++seg >= (int)MAX_ARRAY) { siw_dbg_qp(tx_qp(c_tx), "to many fragments\n"); siw_unmap_pages(iov, kmap_mask, seg-1); wqe->processed -= c_tx->bytes_unsent; |