IB/rxe: fix error code in rxe_srq_from_init()
Subsystems (2)
PATCH 1/1 IB/rxe: fix error code in rxe_srq_from_init()
If copy_to_user() fails then it returns the number of bytes not copied. It would be between 1-4 here. Later the callers dereference it leading to an Oops.
It was sort of hard to fix this without making the code confusing so I did a little cleanup.
drivers/infiniband/hw/rxe/rxe_srq.c +8 -10
@@ -121,8 +121,7 @@ int rxe_srq_from_init(struct rxe_dev *rxe, struct rxe_srq *srq, srq_wqe_size);if (!q) {pr_warn ("unable to allocate queue for srq\n" ); - err = -ENOMEM ; - goto err1; +return -ENOMEM ; } srq->rq.queue = q;
@@ -130,15 +129,14 @@ int rxe_srq_from_init(struct rxe_dev *rxe, struct rxe_srq *srq, err =do_mmap_info (rxe, udata, false, context, q->buf, q->buf_size, &q->ip);if (err) - goto err1; +return err; -if (udata && udata->outlen >=sizeof (struct mminfo ) +sizeof (u32)) -return copy_to_user (udata->outbuf +sizeof (struct mminfo ), - &srq->srq_num,sizeof (u32)); -else -return 0 ; -err1: -return err; +if (udata && udata->outlen >=sizeof (struct mminfo ) +sizeof (u32)) { +if (copy_to_user (udata->outbuf +sizeof (struct mminfo ), + &srq->srq_num,sizeof (u32))) +return -EFAULT ; + } +return 0 ; } int rxe_srq_from_attr(struct rxe_dev *rxe, struct rxe_srq *srq,
Quoted 9 lines · Dan Carpenter
If
copy_to_user()fails then it returns the number of bytes not copied. It would be between 1-4 here. Later the callers dereference it leading to an Oops.It was sort of hard to fix this without making the code confusing so I did a little cleanup.
Fixes 443c15d23220 ('IB/rxe: Shared Receive Queue (SRQ) manipulation functions')Signed-off-by Dan Carpenter <[email protected]>
Thanks Dan
I'll merge it to next series
Quoted 9 lines · Dan Carpenter
If
copy_to_user()fails then it returns the number of bytes not copied. It would be between 1-4 here. Later the callers dereference it leading to an Oops.It was sort of hard to fix this without making the code confusing so I did a little cleanup.
Fixes 443c15d23220 ('IB/rxe: Shared Receive Queue (SRQ) manipulation functions')Signed-off-by Dan Carpenter <[email protected]>
Thanks Dan,
I applied it on topic/rxe.