From: Dennis Dalessandro <dennis.dalessandro@intel.com>
Date: Mon, 29 May 2017 17:19:21 -0700
Subject: IB/hfi1: Use QPN mask to avoid overflow
Patch-mainline: v4.14-rc1
Git-commit: 6c31e5283cb06b81a13cc88da2f2ad3db594a935
References: bsc#1060463 FATE#323043
Ensure we can't come up with an array size that is bigger than the array
by applying the QPN mask before the divide in the free_qpn function.
Reviewed-by: Michael J. Ruhl <michael.j.ruhl@intel.com>
Signed-off-by: Dennis Dalessandro <dennis.dalessandro@intel.com>
Signed-off-by: Doug Ledford <dledford@redhat.com>
Acked-by: Thomas Bogendoerfer <tbogendoerfer@suse.de>
---
drivers/infiniband/sw/rdmavt/qp.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/infiniband/sw/rdmavt/qp.c
+++ b/drivers/infiniband/sw/rdmavt/qp.c
@@ -644,7 +644,7 @@ static void rvt_free_qpn(struct rvt_qpn_
{
struct rvt_qpn_map *map;
- map = qpt->map + qpn / RVT_BITS_PER_PAGE;
+ map = qpt->map + (qpn & RVT_QPN_MASK) / RVT_BITS_PER_PAGE;
if (map->page)
clear_bit(qpn & RVT_BITS_PER_PAGE_MASK, map->page);
}