From: Minwoo Im Date: Thu, 16 Nov 2017 16:34:24 +0000 (+0900) Subject: nvme-pci: avoid hmb desc array idx out-of-bound when hmmaxd set. X-Git-Tag: v4.14.17~107 X-Git-Url: http://review.tizen.org/git/?a=commitdiff_plain;h=93a4bcf2c4252a518a128df1d017a7d5b1a814c2;p=platform%2Fkernel%2Flinux-rpi.git nvme-pci: avoid hmb desc array idx out-of-bound when hmmaxd set. [ Upstream commit 244a8fe40a09c218622eb9927b9090b0a9b73a1a ] hmb descriptor idx out-of-bound occurs in case of below conditions. preferred = 128MiB chunk_size = 4MiB hmmaxd = 1 Current code will not allow rmmod which will free hmb descriptors to be done successfully in above case. "descs[i]" will be set in for-loop without seeing any conditions related to "max_entries" after a single "descs" was allocated by (max_entries = 1) in this case. Added a condition into for-loop to check index of descriptors. Fixes: 044a9df1("nvme-pci: implement the HMB entry number and size limitations") Signed-off-by: Minwoo Im Reviewed-by: Keith Busch Signed-off-by: Christoph Hellwig Signed-off-by: Sasha Levin Signed-off-by: Greg Kroah-Hartman --- diff --git a/drivers/nvme/host/pci.c b/drivers/nvme/host/pci.c index 66d872b..5dae650 100644 --- a/drivers/nvme/host/pci.c +++ b/drivers/nvme/host/pci.c @@ -1645,7 +1645,7 @@ static int __nvme_alloc_host_mem(struct nvme_dev *dev, u64 preferred, if (!bufs) goto out_free_descs; - for (size = 0; size < preferred; size += len) { + for (size = 0; size < preferred && i < max_entries; size += len) { dma_addr_t dma_addr; len = min_t(u64, chunk_size, preferred - size);