Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1755697AbcJFIgi (ORCPT ); Thu, 6 Oct 2016 04:36:38 -0400 Received: from mail.linuxfoundation.org ([140.211.169.12]:47120 "EHLO mail.linuxfoundation.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1755677AbcJFIgf (ORCPT ); Thu, 6 Oct 2016 04:36:35 -0400 From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Stefan Assmann , Mustafa Ismail , Shiraz Saleem , Doug Ledford Subject: [PATCH 4.7 040/141] i40iw: Change mem_resources pointer to a u8 Date: Thu, 6 Oct 2016 10:27:56 +0200 Message-Id: <20161006074450.405477805@linuxfoundation.org> X-Mailer: git-send-email 2.10.0 In-Reply-To: <20161006074448.608056610@linuxfoundation.org> References: <20161006074448.608056610@linuxfoundation.org> User-Agent: quilt/0.64 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 1272 Lines: 38 4.7-stable review patch. If anyone has any objections, please let me know. ------------------ From: Shiraz Saleem commit 6c7d46fdb8165ece4b0a17fb8f0b9320dbfeffc2 upstream. iwdev->mem_resources is incorrectly defined as an unsigned long instead of u8. As a result, the offset into the dynamic allocated structures in i40iw_initialize_hw_resources() is incorrectly calculated and would lead to writing of memory regions outside of the allocated buffer. Fixes: 8e06af711bf2 ("i40iw: add main, hdr, status") Reported-by: Stefan Assmann Signed-off-by: Mustafa Ismail Signed-off-by: Shiraz Saleem Signed-off-by: Doug Ledford Signed-off-by: Greg Kroah-Hartman --- drivers/infiniband/hw/i40iw/i40iw.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) --- a/drivers/infiniband/hw/i40iw/i40iw.h +++ b/drivers/infiniband/hw/i40iw/i40iw.h @@ -232,7 +232,7 @@ struct i40iw_device { struct i40e_client *client; struct i40iw_hw hw; struct i40iw_cm_core cm_core; - unsigned long *mem_resources; + u8 *mem_resources; unsigned long *allocated_qps; unsigned long *allocated_cqs; unsigned long *allocated_mrs;