From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1762315AbcINN6Q (ORCPT ); Wed, 14 Sep 2016 09:58:16 -0400 Received: from mail-wm0-f65.google.com ([74.125.82.65]:36709 "EHLO mail-wm0-f65.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1756110AbcINN6N (ORCPT ); Wed, 14 Sep 2016 09:58:13 -0400 Subject: Re: [PATCH] net/mlx4_en: fix off by one in error handling To: Sebastian Ott , Yishai Hadas , Tariq Toukan References: Cc: netdev@vger.kernel.org, linux-rdma@vger.kernel.org, linux-kernel@vger.kernel.org From: Tariq Toukan Message-ID: Date: Wed, 14 Sep 2016 16:43:33 +0300 User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:45.0) Gecko/20100101 Thunderbird/45.3.0 MIME-Version: 1.0 In-Reply-To: Content-Type: text/plain; charset=windows-1252; format=flowed Content-Transfer-Encoding: 7bit Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Hi Sebastian, Thanks for this fix. On 14/09/2016 2:09 PM, Sebastian Ott wrote: > If an error occurs in mlx4_init_eq_table the index used in the > err_out_unmap label is one too big which results in a panic in > mlx4_free_eq. This patch fixes the index in the error path. You are right, but your change below does not cover all cases. The full solution looks like this: @@ -1260,7 +1260,7 @@ int mlx4_init_eq_table(struct mlx4_dev *dev) eq); } if (err) - goto err_out_unmap; + goto err_out_unmap_excluded; } if (dev->flags & MLX4_FLAG_MSI_X) { @@ -1306,8 +1306,10 @@ int mlx4_init_eq_table(struct mlx4_dev *dev) return 0; err_out_unmap: - while (i >= 0) - mlx4_free_eq(dev, &priv->eq_table.eq[i--]); + mlx4_free_eq(dev, &priv->eq_table.eq[i]); +err_out_unmap_excluded: + while (i > 0) + mlx4_free_eq(dev, &priv->eq_table.eq[--i]); #ifdef CONFIG_RFS_ACCEL for (i = 1; i <= dev->caps.num_ports; i++) { if (mlx4_priv(dev)->port[i].rmap) { > > Signed-off-by: Sebastian Ott > --- > drivers/net/ethernet/mellanox/mlx4/eq.c | 4 ++-- > 1 file changed, 2 insertions(+), 2 deletions(-) > > diff --git a/drivers/net/ethernet/mellanox/mlx4/eq.c b/drivers/net/ethernet/mellanox/mlx4/eq.c > index f613977..cf8f8a7 100644 > --- a/drivers/net/ethernet/mellanox/mlx4/eq.c > +++ b/drivers/net/ethernet/mellanox/mlx4/eq.c > @@ -1305,8 +1305,8 @@ int mlx4_init_eq_table(struct mlx4_dev *dev) > return 0; > > err_out_unmap: > - while (i >= 0) > - mlx4_free_eq(dev, &priv->eq_table.eq[i--]); > + while (i > 0) > + mlx4_free_eq(dev, &priv->eq_table.eq[--i]); > #ifdef CONFIG_RFS_ACCEL > for (i = 1; i <= dev->caps.num_ports; i++) { > if (mlx4_priv(dev)->port[i].rmap) { You can choose to submit again, or we can take it from here. Whatever you prefer. Regards, Tariq