diff options
| author | Brian Behlendorf <[email protected]> | 2018-05-01 20:44:24 -0700 |
|---|---|---|
| committer | GitHub <[email protected]> | 2018-05-01 20:44:24 -0700 |
| commit | bc8a6a60e9f0fd219e10f355384d87a41d4f5882 (patch) | |
| tree | 67615329d59db506d8a5ad5cde6fe28ee2c0d761 /module/zfs/qat_compress.c | |
| parent | 2c24b5b1487646f68960f25e13a1b0df645d4f49 (diff) | |
Fix inst_num overflow in qat_crypt.c
This patch fixes the same issue which was previously addressed in
6051. The variable "inst_num" was of the incorrect type and
"atomic_inc_32_nv()" could cause an overflow damaging its neighbor.
Cast the return value of atomic_inc_32_nv() to Cpa32U.
Fix a few types for num_inst for clarity.
Reviewed-by: Weigang Li <[email protected]>
Signed-off-by: Brian Behlendorf <[email protected]>
Closes #7468
Diffstat (limited to 'module/zfs/qat_compress.c')
| -rw-r--r-- | module/zfs/qat_compress.c | 8 |
1 files changed, 3 insertions, 5 deletions
diff --git a/module/zfs/qat_compress.c b/module/zfs/qat_compress.c index 115316297..8c1410c9e 100644 --- a/module/zfs/qat_compress.c +++ b/module/zfs/qat_compress.c @@ -71,9 +71,8 @@ qat_dc_clean(void) { Cpa16U buff_num = 0; Cpa16U num_inter_buff_lists = 0; - Cpa16U i = 0; - for (i = 0; i < num_inst; i++) { + for (Cpa16U i = 0; i < num_inst; i++) { cpaDcStopInstance(dc_inst_handles[i]); QAT_PHYS_CONTIG_FREE(session_handles[i]); /* free intermediate buffers */ @@ -111,7 +110,6 @@ qat_dc_init(void) Cpa16U buff_num = 0; Cpa32U buff_meta_size = 0; CpaDcSessionSetupData sd = {0}; - Cpa16U i; status = cpaDcGetNumInstances(&num_inst); if (status != CPA_STATUS_SUCCESS) @@ -128,7 +126,7 @@ qat_dc_init(void) if (status != CPA_STATUS_SUCCESS) return (-1); - for (i = 0; i < num_inst; i++) { + for (Cpa16U i = 0; i < num_inst; i++) { cpaDcSetAddressTranslation(dc_inst_handles[i], (void*)virt_to_phys); @@ -286,7 +284,7 @@ qat_compress_impl(qat_compress_dir_t dir, char *src, int src_len, num_add_buf * sizeof (struct page *)) != CPA_STATUS_SUCCESS) goto fail; - i = atomic_inc_32_nv(&inst_num) % num_inst; + i = (Cpa32U)atomic_inc_32_nv(&inst_num) % num_inst; dc_inst_handle = dc_inst_handles[i]; session_handle = session_handles[i]; |