Patch "RDMA/rtrs-clt: Reset cid to con_num - 1 to stay in bounds" has been added to the 6.11-stable tree

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



This is a note to let you know that I've just added the patch titled

    RDMA/rtrs-clt: Reset cid to con_num - 1 to stay in bounds

to the 6.11-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     rdma-rtrs-clt-reset-cid-to-con_num-1-to-stay-in-boun.patch
and it can be found in the queue-6.11 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.



commit 7471e185623c23f0d9aa1d19bc586493dd015afa
Author: Md Haris Iqbal <haris.iqbal@xxxxxxxxx>
Date:   Wed Aug 21 13:22:12 2024 +0200

    RDMA/rtrs-clt: Reset cid to con_num - 1 to stay in bounds
    
    [ Upstream commit 3e4289b29e216a55d08a89e126bc0b37cbad9f38 ]
    
    In the function init_conns(), after the create_con() and create_cm() for
    loop if something fails. In the cleanup for loop after the destroy tag, we
    access out of bound memory because cid is set to clt_path->s.con_num.
    
    This commits resets the cid to clt_path->s.con_num - 1, to stay in bounds
    in the cleanup loop later.
    
    Fixes: 6a98d71daea1 ("RDMA/rtrs: client: main functionality")
    Signed-off-by: Md Haris Iqbal <haris.iqbal@xxxxxxxxx>
    Signed-off-by: Jack Wang <jinpu.wang@xxxxxxxxx>
    Signed-off-by: Grzegorz Prajsner <grzegorz.prajsner@xxxxxxxxx>
    Link: https://patch.msgid.link/20240821112217.41827-7-haris.iqbal@xxxxxxxxx
    Signed-off-by: Leon Romanovsky <leon@xxxxxxxxxx>
    Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>

diff --git a/drivers/infiniband/ulp/rtrs/rtrs-clt.c b/drivers/infiniband/ulp/rtrs/rtrs-clt.c
index 9936a3354b478..84d2dfcd20af6 100644
--- a/drivers/infiniband/ulp/rtrs/rtrs-clt.c
+++ b/drivers/infiniband/ulp/rtrs/rtrs-clt.c
@@ -2347,6 +2347,12 @@ static int init_conns(struct rtrs_clt_path *clt_path)
 		if (err)
 			goto destroy;
 	}
+
+	/*
+	 * Set the cid to con_num - 1, since if we fail later, we want to stay in bounds.
+	 */
+	cid = clt_path->s.con_num - 1;
+
 	err = alloc_path_reqs(clt_path);
 	if (err)
 		goto destroy;




[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Index of Archives]     [Linux USB Devel]     [Linux Audio Users]     [Yosemite News]     [Linux Kernel]     [Linux SCSI]

  Powered by Linux