| Message ID | 20180401063457.5250-1-yuval.shaia@oracle.com (mailing list archive) |
|---|---|
| State | Superseded |
| Delegated to: | Leon Romanovsky |
| Headers | show |
>-----Original Message----- >From: linux-rdma-owner@vger.kernel.org [mailto:linux-rdma- >owner@vger.kernel.org] On Behalf Of Yuval Shaia >Sent: Sunday, April 1, 2018 2:35 AM >To: dledford@redhat.com; jgg@mellanox.com; leonro@mellanox.com; linux- >rdma@vger.kernel.org >Cc: Yuval Shaia <yuval.shaia@oracle.com> >Subject: [PATCH] libibverb/examples: Protect against memory corruption > >Make sure num_qp is less than MAX_QP so we will not overrun my_dest >array. > >Signed-off-by: Yuval Shaia <yuval.shaia@oracle.com> >--- > libibverbs/examples/srq_pingpong.c | 6 ++++++ > 1 file changed, 6 insertions(+) > >diff --git a/libibverbs/examples/srq_pingpong.c >b/libibverbs/examples/srq_pingpong.c >index c289b463..f0a3c221 100644 >--- a/libibverbs/examples/srq_pingpong.c >+++ b/libibverbs/examples/srq_pingpong.c >@@ -759,6 +759,12 @@ int main(int argc, char *argv[]) > return 1; > } > >+ if (num_qp > MAX_QP) { So shouldn't this be >=? M >+ fprintf(stderr, "num_qp %d must be less than %d\n", >num_qp, >+ MAX_QP); >+ return 1; >+ } >+ > num_wc = num_qp + rx_depth; > wc = alloca(num_wc * sizeof *wc); > >-- >2.14.3 > >-- >To unsubscribe from this list: send the line "unsubscribe linux-rdma" in >the body of a message to majordomo@vger.kernel.org >More majordomo info at http://vger.kernel.org/majordomo-info.html -- To unsubscribe from this list: send the line "unsubscribe linux-rdma" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html
On Mon, Apr 02, 2018 at 11:26:11AM +0000, Ruhl, Michael J wrote: > >-----Original Message----- > >From: linux-rdma-owner@vger.kernel.org [mailto:linux-rdma- > >owner@vger.kernel.org] On Behalf Of Yuval Shaia > >Sent: Sunday, April 1, 2018 2:35 AM > >To: dledford@redhat.com; jgg@mellanox.com; leonro@mellanox.com; linux- > >rdma@vger.kernel.org > >Cc: Yuval Shaia <yuval.shaia@oracle.com> > >Subject: [PATCH] libibverb/examples: Protect against memory corruption > > > >Make sure num_qp is less than MAX_QP so we will not overrun my_dest > >array. > > > >Signed-off-by: Yuval Shaia <yuval.shaia@oracle.com> > >--- > > libibverbs/examples/srq_pingpong.c | 6 ++++++ > > 1 file changed, 6 insertions(+) > > > >diff --git a/libibverbs/examples/srq_pingpong.c > >b/libibverbs/examples/srq_pingpong.c > >index c289b463..f0a3c221 100644 > >--- a/libibverbs/examples/srq_pingpong.c > >+++ b/libibverbs/examples/srq_pingpong.c > >@@ -759,6 +759,12 @@ int main(int argc, char *argv[]) > > return 1; > > } > > > >+ if (num_qp > MAX_QP) { > > So shouldn't this be >=? Correct, re-posting. > > M > > >+ fprintf(stderr, "num_qp %d must be less than %d\n", > >num_qp, > >+ MAX_QP); > >+ return 1; > >+ } > >+ > > num_wc = num_qp + rx_depth; > > wc = alloca(num_wc * sizeof *wc); > > > >-- > >2.14.3 > > > >-- > >To unsubscribe from this list: send the line "unsubscribe linux-rdma" in > >the body of a message to majordomo@vger.kernel.org > >More majordomo info at http://vger.kernel.org/majordomo-info.html > -- > To unsubscribe from this list: send the line "unsubscribe linux-rdma" in > the body of a message to majordomo@vger.kernel.org > More majordomo info at http://vger.kernel.org/majordomo-info.html -- To unsubscribe from this list: send the line "unsubscribe linux-rdma" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html
diff --git a/libibverbs/examples/srq_pingpong.c b/libibverbs/examples/srq_pingpong.c index c289b463..f0a3c221 100644 --- a/libibverbs/examples/srq_pingpong.c +++ b/libibverbs/examples/srq_pingpong.c @@ -759,6 +759,12 @@ int main(int argc, char *argv[]) return 1; } + if (num_qp > MAX_QP) { + fprintf(stderr, "num_qp %d must be less than %d\n", num_qp, + MAX_QP); + return 1; + } + num_wc = num_qp + rx_depth; wc = alloca(num_wc * sizeof *wc);
Make sure num_qp is less than MAX_QP so we will not overrun my_dest array. Signed-off-by: Yuval Shaia <yuval.shaia@oracle.com> --- libibverbs/examples/srq_pingpong.c | 6 ++++++ 1 file changed, 6 insertions(+)