Skip to content

Commit

Permalink
RDMA/rtrs: Fix a couple off by one bugs in rtrs_srv_rdma_done()
Browse files Browse the repository at this point in the history
These > comparisons should be >= to prevent accessing one element beyond
the end of the buffer.

Fixes: 9cb8374 ("RDMA/rtrs: server: main functionality")
Link: https://lore.kernel.org/r/20200519154525.GA66801@mwanda
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Acked-by: Danil Kipnis <danil.kipnis@cloud.ionos.com>
Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
  • Loading branch information
Dan Carpenter authored and Jason Gunthorpe committed May 19, 2020
1 parent b386cd6 commit bf1d8ed
Showing 1 changed file with 2 additions and 2 deletions.
4 changes: 2 additions & 2 deletions drivers/infiniband/ulp/rtrs/rtrs-srv.c
Original file line number Diff line number Diff line change
Expand Up @@ -1213,8 +1213,8 @@ static void rtrs_srv_rdma_done(struct ib_cq *cq, struct ib_wc *wc)

msg_id = imm_payload >> sess->mem_bits;
off = imm_payload & ((1 << sess->mem_bits) - 1);
if (unlikely(msg_id > srv->queue_depth ||
off > max_chunk_size)) {
if (unlikely(msg_id >= srv->queue_depth ||
off >= max_chunk_size)) {
rtrs_err(s, "Wrong msg_id %u, off %u\n",
msg_id, off);
close_sess(sess);
Expand Down

0 comments on commit bf1d8ed

Please sign in to comment.