From: Weihang Li Date: Mon, 22 Mar 2021 02:44:29 +0000 (+0800) Subject: RDMA/hns: Fix memory corruption when allocating XRCDN X-Git-Url: http://git.maquefel.me/?a=commitdiff_plain;h=783cf673b05ebf290317f583ee7eb6967ed9c964;p=linux.git RDMA/hns: Fix memory corruption when allocating XRCDN It's incorrect to cast the type of pointer to xrcdn from (u32 *) to (unsigned long *), then pass it into hns_roce_bitmap_alloc(), this will lead to a memory corruption. Fixes: 32548870d438 ("RDMA/hns: Add support for XRC on HIP09") Link: https://lore.kernel.org/r/1616381069-51759-1-git-send-email-liweihang@huawei.com Reported-by: Dan Carpenter Signed-off-by: Weihang Li Reviewed-by: Leon Romanovsky Signed-off-by: Jason Gunthorpe --- diff --git a/drivers/infiniband/hw/hns/hns_roce_pd.c b/drivers/infiniband/hw/hns/hns_roce_pd.c index 3ca51ce1813a2..a5813bf567b2a 100644 --- a/drivers/infiniband/hw/hns/hns_roce_pd.c +++ b/drivers/infiniband/hw/hns/hns_roce_pd.c @@ -140,8 +140,16 @@ void hns_roce_cleanup_uar_table(struct hns_roce_dev *hr_dev) static int hns_roce_xrcd_alloc(struct hns_roce_dev *hr_dev, u32 *xrcdn) { - return hns_roce_bitmap_alloc(&hr_dev->xrcd_bitmap, - (unsigned long *)xrcdn); + unsigned long obj; + int ret; + + ret = hns_roce_bitmap_alloc(&hr_dev->xrcd_bitmap, &obj); + if (ret) + return ret; + + *xrcdn = obj; + + return 0; } static void hns_roce_xrcd_free(struct hns_roce_dev *hr_dev,