Skip to content

Commit 117697c

Browse files
tititiou36jgunthorpe
authored andcommitted
RDMA/irdma: Fix a potential memory allocation issue in 'irdma_prm_add_pble_mem()'
'pchunk->bitmapbuf' is a bitmap. Its size (in number of bits) is stored in 'pchunk->sizeofbitmap'. When it is allocated, the size (in bytes) is computed by: size_in_bits >> 3 There are 2 issues (numbers bellow assume that longs are 64 bits): - there is no guarantee here that 'pchunk->bitmapmem.size' is modulo BITS_PER_LONG but bitmaps are stored as longs (sizeofbitmap=8 bits will only allocate 1 byte, instead of 8 (1 long)) - the number of bytes is computed with a shift, not a round up, so we may allocate less memory than needed (sizeofbitmap=65 bits will only allocate 8 bytes (i.e. 1 long), when 2 longs are needed = 16 bytes) Fix both issues by using 'bitmap_zalloc()' and remove the useless 'bitmapmem' from 'struct irdma_chunk'. While at it, remove some useless NULL test before calling kfree/bitmap_free. Fixes: 915cc7a ("RDMA/irdma: Add miscellaneous utility definitions") Link: https://lore.kernel.org/r/5e670b640508e14b1869c3e8e4fb970d78cbe997.1638692171.git.christophe.jaillet@wanadoo.fr Signed-off-by: Christophe JAILLET <[email protected]> Reviewed-by: Shiraz Saleem <[email protected]> Signed-off-by: Jason Gunthorpe <[email protected]>
1 parent 1e11a39 commit 117697c

File tree

3 files changed

+4
-12
lines changed

3 files changed

+4
-12
lines changed

drivers/infiniband/hw/irdma/pble.c

Lines changed: 2 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -25,8 +25,7 @@ void irdma_destroy_pble_prm(struct irdma_hmc_pble_rsrc *pble_rsrc)
2525
list_del(&chunk->list);
2626
if (chunk->type == PBLE_SD_PAGED)
2727
irdma_pble_free_paged_mem(chunk);
28-
if (chunk->bitmapbuf)
29-
kfree(chunk->bitmapmem.va);
28+
bitmap_free(chunk->bitmapbuf);
3029
kfree(chunk->chunkmem.va);
3130
}
3231
}
@@ -299,8 +298,7 @@ add_pble_prm(struct irdma_hmc_pble_rsrc *pble_rsrc)
299298
return 0;
300299

301300
error:
302-
if (chunk->bitmapbuf)
303-
kfree(chunk->bitmapmem.va);
301+
bitmap_free(chunk->bitmapbuf);
304302
kfree(chunk->chunkmem.va);
305303

306304
return ret_code;

drivers/infiniband/hw/irdma/pble.h

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -78,7 +78,6 @@ struct irdma_chunk {
7878
u32 pg_cnt;
7979
enum irdma_alloc_type type;
8080
struct irdma_sc_dev *dev;
81-
struct irdma_virt_mem bitmapmem;
8281
struct irdma_virt_mem chunkmem;
8382
};
8483

drivers/infiniband/hw/irdma/utils.c

Lines changed: 2 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -2239,15 +2239,10 @@ enum irdma_status_code irdma_prm_add_pble_mem(struct irdma_pble_prm *pprm,
22392239

22402240
sizeofbitmap = (u64)pchunk->size >> pprm->pble_shift;
22412241

2242-
pchunk->bitmapmem.size = sizeofbitmap >> 3;
2243-
pchunk->bitmapmem.va = kzalloc(pchunk->bitmapmem.size, GFP_KERNEL);
2244-
2245-
if (!pchunk->bitmapmem.va)
2242+
pchunk->bitmapbuf = bitmap_zalloc(sizeofbitmap, GFP_KERNEL);
2243+
if (!pchunk->bitmapbuf)
22462244
return IRDMA_ERR_NO_MEMORY;
22472245

2248-
pchunk->bitmapbuf = pchunk->bitmapmem.va;
2249-
bitmap_zero(pchunk->bitmapbuf, sizeofbitmap);
2250-
22512246
pchunk->sizeofbitmap = sizeofbitmap;
22522247
/* each pble is 8 bytes hence shift by 3 */
22532248
pprm->total_pble_alloc += pchunk->size >> 3;

0 commit comments

Comments
 (0)