RDMA/bnxt_re: Use correct sizing on buffers holding page DMA addresses
authorSelvin Xavier <selvin.xavier@broadcom.com>
Thu, 28 Mar 2019 16:49:43 +0000 (11:49 -0500)
committerJason Gunthorpe <jgg@mellanox.com>
Thu, 28 Mar 2019 17:13:27 +0000 (14:13 -0300)
commit5aa8484080115cff2da68080ad1d115613648504
treedfd69350691e899b676149e8851b3fa197291b9c
parent196b4ce57d1612ca03be3c7f14bfb6b0740c5c53
RDMA/bnxt_re: Use correct sizing on buffers holding page DMA addresses

umem->nmap is used while allocating internal buffer for storing
page DMA addresses. This causes out of bounds array access while iterating
the umem DMA-mapped SGL with umem page combining as umem->nmap can be
less than number of system pages in umem.

Use ib_umem_num_pages() instead of umem->nmap to size the page array.
Add a new structure (bnxt_qplib_sg_info) to pass sglist, npages and nmap.

Signed-off-by: Selvin Xavier <selvin.xavier@broadcom.com>
Signed-off-by: Shiraz Saleem <shiraz.saleem@intel.com>
Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
drivers/infiniband/hw/bnxt_re/ib_verbs.c
drivers/infiniband/hw/bnxt_re/qplib_fp.c
drivers/infiniband/hw/bnxt_re/qplib_fp.h
drivers/infiniband/hw/bnxt_re/qplib_rcfw.c
drivers/infiniband/hw/bnxt_re/qplib_res.c
drivers/infiniband/hw/bnxt_re/qplib_res.h
drivers/infiniband/hw/bnxt_re/qplib_sp.c