RDMA/rtrs-clt: Reset cid to con_num - 1 to stay in bounds
authorMd Haris Iqbal <haris.iqbal@ionos.com>
Wed, 21 Aug 2024 11:22:12 +0000 (13:22 +0200)
committerLeon Romanovsky <leon@kernel.org>
Wed, 28 Aug 2024 12:24:35 +0000 (15:24 +0300)
commit3e4289b29e216a55d08a89e126bc0b37cbad9f38
tree781e265ec329bc26fc3e042513553bd953a8869e
parent6793f9581f75d98c5ba0753e863a5442a9dff07c
RDMA/rtrs-clt: Reset cid to con_num - 1 to stay in bounds

In the function init_conns(), after the create_con() and create_cm() for
loop if something fails. In the cleanup for loop after the destroy tag, we
access out of bound memory because cid is set to clt_path->s.con_num.

This commits resets the cid to clt_path->s.con_num - 1, to stay in bounds
in the cleanup loop later.

Fixes: 6a98d71daea1 ("RDMA/rtrs: client: main functionality")
Signed-off-by: Md Haris Iqbal <haris.iqbal@ionos.com>
Signed-off-by: Jack Wang <jinpu.wang@ionos.com>
Signed-off-by: Grzegorz Prajsner <grzegorz.prajsner@ionos.com>
Link: https://patch.msgid.link/20240821112217.41827-7-haris.iqbal@ionos.com
Signed-off-by: Leon Romanovsky <leon@kernel.org>
drivers/infiniband/ulp/rtrs/rtrs-clt.c