* [PATCH][net-next] sfc: fix an off-by-one compare on an array size
@ 2017-01-31 16:30 Colin King
2017-01-31 16:37 ` Edward Cree
0 siblings, 1 reply; 3+ messages in thread
From: Colin King @ 2017-01-31 16:30 UTC (permalink / raw)
To: Solarflare linux maintainers, Edward Cree, Bert Kenward, netdev
Cc: kernel-janitors, linux-kernel
From: Colin Ian King <colin.king@canonical.com>
encap_type should be checked to see if it is greater or equal to
the size of array map to fix an off-by-one array size check. This
fixes an array overrun read as detected by static analysis by
CoverityScan, CID#1398883 ("Out-of-bounds-read")
Fixes: 9b41080125176841e ("sfc: insert catch-all filters for encapsulated traffic")
Signed-off-by: Colin Ian King <colin.king@canonical.com>
---
drivers/net/ethernet/sfc/ef10.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/net/ethernet/sfc/ef10.c b/drivers/net/ethernet/sfc/ef10.c
index 8bec938..0475f18 100644
--- a/drivers/net/ethernet/sfc/ef10.c
+++ b/drivers/net/ethernet/sfc/ef10.c
@@ -5080,7 +5080,7 @@ static int efx_ef10_filter_insert_def(struct efx_nic *efx,
/* quick bounds check (BCAST result impossible) */
BUILD_BUG_ON(EFX_EF10_BCAST != 0);
- if (encap_type > ARRAY_SIZE(map) || map[encap_type] == 0) {
+ if (encap_type >= ARRAY_SIZE(map) || map[encap_type] == 0) {
WARN_ON(1);
return -EINVAL;
}
--
2.10.2
^ permalink raw reply related [flat|nested] 3+ messages in thread
* Re: [PATCH][net-next] sfc: fix an off-by-one compare on an array size
2017-01-31 16:30 [PATCH][net-next] sfc: fix an off-by-one compare on an array size Colin King
@ 2017-01-31 16:37 ` Edward Cree
2017-01-31 17:26 ` David Miller
0 siblings, 1 reply; 3+ messages in thread
From: Edward Cree @ 2017-01-31 16:37 UTC (permalink / raw)
To: Colin King, Solarflare linux maintainers, Bert Kenward, netdev
Cc: kernel-janitors, linux-kernel
On 31/01/17 16:30, Colin King wrote:
> From: Colin Ian King <colin.king@canonical.com>
>
> encap_type should be checked to see if it is greater or equal to
> the size of array map to fix an off-by-one array size check. This
> fixes an array overrun read as detected by static analysis by
> CoverityScan, CID#1398883 ("Out-of-bounds-read")
>
> Fixes: 9b41080125176841e ("sfc: insert catch-all filters for encapsulated traffic")
> Signed-off-by: Colin Ian King <colin.king@canonical.com>
Good catch.
Acked-by: Edward Cree <ecree@solarflare.com>
> ---
> drivers/net/ethernet/sfc/ef10.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/drivers/net/ethernet/sfc/ef10.c b/drivers/net/ethernet/sfc/ef10.c
> index 8bec938..0475f18 100644
> --- a/drivers/net/ethernet/sfc/ef10.c
> +++ b/drivers/net/ethernet/sfc/ef10.c
> @@ -5080,7 +5080,7 @@ static int efx_ef10_filter_insert_def(struct efx_nic *efx,
>
> /* quick bounds check (BCAST result impossible) */
> BUILD_BUG_ON(EFX_EF10_BCAST != 0);
> - if (encap_type > ARRAY_SIZE(map) || map[encap_type] == 0) {
> + if (encap_type >= ARRAY_SIZE(map) || map[encap_type] == 0) {
> WARN_ON(1);
> return -EINVAL;
> }
^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: [PATCH][net-next] sfc: fix an off-by-one compare on an array size
2017-01-31 16:37 ` Edward Cree
@ 2017-01-31 17:26 ` David Miller
0 siblings, 0 replies; 3+ messages in thread
From: David Miller @ 2017-01-31 17:26 UTC (permalink / raw)
To: ecree
Cc: colin.king, linux-net-drivers, bkenward, netdev, kernel-janitors,
linux-kernel
From: Edward Cree <ecree@solarflare.com>
Date: Tue, 31 Jan 2017 16:37:10 +0000
> On 31/01/17 16:30, Colin King wrote:
>> From: Colin Ian King <colin.king@canonical.com>
>>
>> encap_type should be checked to see if it is greater or equal to
>> the size of array map to fix an off-by-one array size check. This
>> fixes an array overrun read as detected by static analysis by
>> CoverityScan, CID#1398883 ("Out-of-bounds-read")
>>
>> Fixes: 9b41080125176841e ("sfc: insert catch-all filters for encapsulated traffic")
>> Signed-off-by: Colin Ian King <colin.king@canonical.com>
> Good catch.
>
> Acked-by: Edward Cree <ecree@solarflare.com>
Applied, thanks everyone.
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2017-01-31 17:36 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2017-01-31 16:30 [PATCH][net-next] sfc: fix an off-by-one compare on an array size Colin King
2017-01-31 16:37 ` Edward Cree
2017-01-31 17:26 ` David Miller
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).