From: Wei Huang <wei.huang@intel.com>
To: dev@dpdk.org, rosen.xu@intel.com, qi.z.zhang@intel.com
Cc: stable@dpdk.org, tianfei.zhang@intel.com, ferruh.yigit@intel.com,
Wei Huang <wei.huang@intel.com>
Subject: [dpdk-dev] [PATCH v2 1/1] raw/ifpga/base: check size before assigning
Date: Thu, 8 Apr 2021 04:51:51 -0400 [thread overview]
Message-ID: <20210408085151.54996-2-wei.huang@intel.com> (raw)
In-Reply-To: <20210408085151.54996-1-wei.huang@intel.com>
In max10_staging_area_init(), variable "size" from fdt_get_reg() may
be invalid, it should be checked before assigning to member variable
"staging_area_size" of structure "intel_max10_device".
Coverity issue: 367480, 367482
Fixes: 96ebfcf8125c ("raw/ifpga/base: add SPI and MAX10 device driver")
Signed-off-by: Wei Huang <wei.huang@intel.com>
---
v2: check size before assigning to staging_area_size
---
drivers/raw/ifpga/base/opae_intel_max10.c | 2 +-
drivers/raw/ifpga/base/opae_intel_max10.h | 1 +
2 files changed, 2 insertions(+), 1 deletion(-)
diff --git a/drivers/raw/ifpga/base/opae_intel_max10.c b/drivers/raw/ifpga/base/opae_intel_max10.c
index 443e248fb3..c223fafa03 100644
--- a/drivers/raw/ifpga/base/opae_intel_max10.c
+++ b/drivers/raw/ifpga/base/opae_intel_max10.c
@@ -593,7 +593,7 @@ static int max10_staging_area_init(struct intel_max10_device *dev)
continue;
ret = fdt_get_reg(fdt_root, offset, 0, &start, &size);
- if (!ret) {
+ if (!ret && (size <= MAX_STAGING_AREA_SIZE)) {
dev->staging_area_base = start;
dev->staging_area_size = size;
}
diff --git a/drivers/raw/ifpga/base/opae_intel_max10.h b/drivers/raw/ifpga/base/opae_intel_max10.h
index 670683f017..e7142d6f0d 100644
--- a/drivers/raw/ifpga/base/opae_intel_max10.h
+++ b/drivers/raw/ifpga/base/opae_intel_max10.h
@@ -182,6 +182,7 @@ struct opae_retimer_status {
#define SBUS_VERSION GENMASK(31, 16)
#define DFT_MAX_SIZE 0x7e0000
+#define MAX_STAGING_AREA_SIZE 0x3800000
int max10_reg_read(struct intel_max10_device *dev,
unsigned int reg, unsigned int *val);
--
2.29.2
next prev parent reply other threads:[~2021-04-08 8:57 UTC|newest]
Thread overview: 13+ messages / expand[flat|nested] mbox.gz Atom feed top
2021-04-08 8:51 [dpdk-dev] [PATCH v2 0/1] Fix coverity issues reported in DPDK-26381 Wei Huang
2021-04-08 8:51 ` Wei Huang [this message]
2021-04-08 9:38 ` [dpdk-dev] [PATCH v2 1/1] raw/ifpga/base: check size before assigning Ferruh Yigit
2021-04-09 14:56 ` Aaron Conole
2021-04-14 2:46 ` Zhang, Tianfei
2021-04-14 7:42 ` Ferruh Yigit
2021-04-16 2:49 ` Huang, Wei
2021-05-17 8:50 ` Ferruh Yigit
2021-04-19 8:12 ` Zhang, Qi Z
2021-04-19 22:35 ` Ferruh Yigit
2021-04-20 0:13 ` Zhang, Tianfei
2021-04-20 1:00 ` Ferruh Yigit
2021-04-20 1:59 ` Xu, Rosen
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20210408085151.54996-2-wei.huang@intel.com \
--to=wei.huang@intel.com \
--cc=dev@dpdk.org \
--cc=ferruh.yigit@intel.com \
--cc=qi.z.zhang@intel.com \
--cc=rosen.xu@intel.com \
--cc=stable@dpdk.org \
--cc=tianfei.zhang@intel.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.