summaryrefslogtreecommitdiff
path: root/drivers/net/ethernet/mellanox/mlx4/cmd.c
diff options
context:
space:
mode:
authorMatan Barak <matanb@mellanox.com>2015-01-27 16:58:07 +0300
committerDavid S. Miller <davem@davemloft.net>2015-01-28 04:12:58 +0300
commit19ab574f6271a2f912a449cfdea14a60098fba90 (patch)
tree60523d1ada891d59bcdb25cd00a847dd7e62e7b8 /drivers/net/ethernet/mellanox/mlx4/cmd.c
parent5a228c03d849c86c10ee69d9951695b0649f82ce (diff)
downloadlinux-19ab574f6271a2f912a449cfdea14a60098fba90.tar.xz
net/mlx4: Fix memory corruption in mlx4_MAD_IFC_wrapper
Fix a memory corruption at mlx4_MAD_IFC_wrapper. A table of size dev->caps.pkey_table_len[port]*sizeof(*table) was allocated, but get_full_pkey_table() assumes that the number of entries in the table is a multiplication of 32 (which isn't always correct). Fixes: 0a9a018 ('mlx4: MAD_IFC paravirtualization') Signed-off-by: Matan Barak <matanb@mellanox.com> Signed-off-by: Or Gerlitz <ogerlitz@mellanox.com> Signed-off-by: Amir Vadai <amirv@mellanox.com> Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'drivers/net/ethernet/mellanox/mlx4/cmd.c')
-rw-r--r--drivers/net/ethernet/mellanox/mlx4/cmd.c4
1 files changed, 3 insertions, 1 deletions
diff --git a/drivers/net/ethernet/mellanox/mlx4/cmd.c b/drivers/net/ethernet/mellanox/mlx4/cmd.c
index 928b7065732c..154effbfd8be 100644
--- a/drivers/net/ethernet/mellanox/mlx4/cmd.c
+++ b/drivers/net/ethernet/mellanox/mlx4/cmd.c
@@ -901,7 +901,9 @@ static int mlx4_MAD_IFC_wrapper(struct mlx4_dev *dev, int slave,
index = be32_to_cpu(smp->attr_mod);
if (port < 1 || port > dev->caps.num_ports)
return -EINVAL;
- table = kcalloc(dev->caps.pkey_table_len[port], sizeof *table, GFP_KERNEL);
+ table = kcalloc((dev->caps.pkey_table_len[port] / 32) + 1,
+ sizeof(*table) * 32, GFP_KERNEL);
+
if (!table)
return -ENOMEM;
/* need to get the full pkey table because the paravirtualized