diff options
| author | Xiao Yang <yangx.jy@fujitsu.com> | 2021-08-20 14:15:09 +0300 |
|---|---|---|
| committer | Jason Gunthorpe <jgg@nvidia.com> | 2021-08-20 21:48:58 +0300 |
| commit | cc4f596cf85e97ca6606e1bd10b3b9851ef52ddf (patch) | |
| tree | 926a27cccf0b31b81a774222e34362edaed3149d /drivers/gpu/drm/nouveau/nouveau_svm.c | |
| parent | dbe986bdfd6dfe6ef24b833767fff4151e024357 (diff) | |
| download | linux-cc4f596cf85e97ca6606e1bd10b3b9851ef52ddf.tar.xz | |
RDMA/rxe: Zero out index member of struct rxe_queue
1) New index member of struct rxe_queue was introduced but not zeroed so
the initial value of index may be random.
2) The current index is not masked off to index_mask.
In this case producer_addr() and consumer_addr() will get an invalid
address by the random index and then accessing the invalid address
triggers the following panic:
"BUG: unable to handle page fault for address: ffff9ae2c07a1414"
Fix the issue by using kzalloc() to zero out index member.
Fixes: 5bcf5a59c41e ("RDMA/rxe: Protext kernel index from user space")
Link: https://lore.kernel.org/r/20210820111509.172500-1-yangx.jy@fujitsu.com
Signed-off-by: Xiao Yang <yangx.jy@fujitsu.com>
Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
Diffstat (limited to 'drivers/gpu/drm/nouveau/nouveau_svm.c')
0 files changed, 0 insertions, 0 deletions