On Thu, Jan 10, 2019 at 04:00:19PM +0300, Dan Carpenter wrote:
> This is from static analysis not from testing. Depending on the value
> of rcfw->cmdq_depth, then this might not cause an issue at runtime.
>
> The BITS_TO_LONGS() macro tells us how many longs it take to hold a
> bitmap. In other words, it divides by the number if bits per long and
> rounds up. Then we want to take that number and multiple by
> sizeof(long) to get the number of bytes to allocate.
>
> The code here does the multiplication first so the rounding up is done
> in the wrong place. So imagine we want to allocate 1 bit, then
> "(1 * 8) / 64 = 1" when we round up. But it should be
> "(1 / 64) * 8 = 8". In other words, because of the rounding difference
> we might allocate up to "sizeof(long) - 1" bytes fewer than intended.
>
> Fixes: 1ac5a4047975 ("RDMA/bnxt_re: Add bnxt_re RoCE driver")
> Signed-off-by: Dan Carpenter <dan.carpenter@xxxxxxxxxx>
> Acked-By: Devesh Sharma <devesh.sharma@xxxxxxxxxxxx>
> ---
> drivers/infiniband/hw/bnxt_re/qplib_rcfw.c | 3 +--
> 1 file changed, 1 insertion(+), 2 deletions(-)
Applied to for-next
Thanks,
Jason
