* [patch] IB/rxe: fix error code in rxe_srq_from_init()
@ 2016-06-13 6:53 Dan Carpenter
2016-06-13 7:24 ` Moni Shoua
2016-06-13 13:20 ` Leon Romanovsky
0 siblings, 2 replies; 3+ messages in thread
From: Dan Carpenter @ 2016-06-13 6:53 UTC (permalink / raw)
To: Moni Shoua
Cc: Doug Ledford, Sean Hefty, Hal Rosenstock, linux-rdma,
linux-kernel, kernel-janitors
If copy_to_user() fails then it returns the number of bytes not copied.
It would be between 1-4 here. Later the callers dereference it leading
to an Oops.
It was sort of hard to fix this without making the code confusing so I
did a little cleanup.
Fixes: 443c15d23220 ('IB/rxe: Shared Receive Queue (SRQ) manipulation functions')
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
diff --git a/drivers/infiniband/hw/rxe/rxe_srq.c b/drivers/infiniband/hw/rxe/rxe_srq.c
index 22c57d1..2a6e3cd 100644
--- a/drivers/infiniband/hw/rxe/rxe_srq.c
+++ b/drivers/infiniband/hw/rxe/rxe_srq.c
@@ -121,8 +121,7 @@ int rxe_srq_from_init(struct rxe_dev *rxe, struct rxe_srq *srq,
srq_wqe_size);
if (!q) {
pr_warn("unable to allocate queue for srq\n");
- err = -ENOMEM;
- goto err1;
+ return -ENOMEM;
}
srq->rq.queue = q;
@@ -130,15 +129,14 @@ int rxe_srq_from_init(struct rxe_dev *rxe, struct rxe_srq *srq,
err = do_mmap_info(rxe, udata, false, context, q->buf,
q->buf_size, &q->ip);
if (err)
- goto err1;
+ return err;
- if (udata && udata->outlen >= sizeof(struct mminfo) + sizeof(u32))
- return copy_to_user(udata->outbuf + sizeof(struct mminfo),
- &srq->srq_num, sizeof(u32));
- else
- return 0;
-err1:
- return err;
+ if (udata && udata->outlen >= sizeof(struct mminfo) + sizeof(u32)) {
+ if (copy_to_user(udata->outbuf + sizeof(struct mminfo),
+ &srq->srq_num, sizeof(u32)))
+ return -EFAULT;
+ }
+ return 0;
}
int rxe_srq_from_attr(struct rxe_dev *rxe, struct rxe_srq *srq,
^ permalink raw reply related [flat|nested] 3+ messages in thread
* Re: [patch] IB/rxe: fix error code in rxe_srq_from_init()
2016-06-13 6:53 [patch] IB/rxe: fix error code in rxe_srq_from_init() Dan Carpenter
@ 2016-06-13 7:24 ` Moni Shoua
2016-06-13 13:20 ` Leon Romanovsky
1 sibling, 0 replies; 3+ messages in thread
From: Moni Shoua @ 2016-06-13 7:24 UTC (permalink / raw)
To: Dan Carpenter
Cc: Doug Ledford, Sean Hefty, Hal Rosenstock, linux-rdma,
linux-kernel, kernel-janitors
On Mon, Jun 13, 2016 at 9:53 AM, Dan Carpenter <dan.carpenter@oracle.com> wrote:
> If copy_to_user() fails then it returns the number of bytes not copied.
> It would be between 1-4 here. Later the callers dereference it leading
> to an Oops.
>
> It was sort of hard to fix this without making the code confusing so I
> did a little cleanup.
>
> Fixes: 443c15d23220 ('IB/rxe: Shared Receive Queue (SRQ) manipulation functions')
> Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Thanks Dan
I'll merge it to next series
^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: [patch] IB/rxe: fix error code in rxe_srq_from_init()
2016-06-13 6:53 [patch] IB/rxe: fix error code in rxe_srq_from_init() Dan Carpenter
2016-06-13 7:24 ` Moni Shoua
@ 2016-06-13 13:20 ` Leon Romanovsky
1 sibling, 0 replies; 3+ messages in thread
From: Leon Romanovsky @ 2016-06-13 13:20 UTC (permalink / raw)
To: Dan Carpenter
Cc: Moni Shoua, Doug Ledford, Sean Hefty, Hal Rosenstock, linux-rdma,
linux-kernel, kernel-janitors
[-- Attachment #1: Type: text/plain, Size: 523 bytes --]
On Mon, Jun 13, 2016 at 09:53:41AM +0300, Dan Carpenter wrote:
> If copy_to_user() fails then it returns the number of bytes not copied.
> It would be between 1-4 here. Later the callers dereference it leading
> to an Oops.
>
> It was sort of hard to fix this without making the code confusing so I
> did a little cleanup.
>
> Fixes: 443c15d23220 ('IB/rxe: Shared Receive Queue (SRQ) manipulation functions')
> Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Thanks Dan,
I applied it on topic/rxe.
[-- Attachment #2: Digital signature --]
[-- Type: application/pgp-signature, Size: 819 bytes --]
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2016-06-13 13:20 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2016-06-13 6:53 [patch] IB/rxe: fix error code in rxe_srq_from_init() Dan Carpenter
2016-06-13 7:24 ` Moni Shoua
2016-06-13 13:20 ` Leon Romanovsky
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).