• Roland Dreier's avatar
    RDMA/nes: Fix off-by-one in nes_reg_user_mr() error path · 24797a34
    Roland Dreier authored
    nes_reg_user_mr() should fail if page_count becomes >= 1024 * 512
    rather than just testing for strict >, because page_count is
    essentially used as an index into an array with 1024 * 512 entries, so
    allowing the loop to continue with page_count == 1024 * 512 means that
    memory after the end of the array is corrupted.  This leads to a crash
    triggerable by a userspace application that requests registration of a
    too-big region.
    
    Also get rid of the call to pci_free_consistent() here to avoid
    corrupting state with a double free, since the same memory will be
    freed in the code jumped to at reg_user_mr_err.
    Signed-off-by: default avatarRoland Dreier <rolandd@cisco.com>
    24797a34
nes_verbs.c 121 KB