Shiraz Saleem 629e6f9db6 RDMA/rdmavt: Use correct sizing on buffers holding page DMA addresses
The buffer that holds the page DMA addresses is sized off umem->nmap.
This can potentially cause out of bound accesses on the PBL array when
iterating the umem DMA-mapped SGL. This is because if umem pages are
combined, umem->nmap can be much lower than the number of system pages
in umem.

Use ib_umem_num_pages() to size this buffer.

Cc: Dennis Dalessandro <dennis.dalessandro@intel.com>
Cc: Mike Marciniszyn <mike.marciniszyn@intel.com>
Cc: Michael J. Ruhl <michael.j.ruhl@intel.com>
Signed-off-by: Shiraz Saleem <shiraz.saleem@intel.com>
Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
2019-03-28 14:13:27 -03:00
..
2016-03-10 20:37:27 -05:00
2016-08-02 16:00:58 -04:00
2019-02-08 16:51:04 -07:00
2019-02-08 16:51:04 -07:00
2016-12-11 15:25:13 -05:00
2016-03-10 20:37:27 -05:00
2018-03-13 16:46:03 -04:00