IB/ipath: add a range check before bumping the stats
Subsystems (2)
PATCH 1/1 IB/ipath: add a range check before bumping the stats
My static checker complains that this could corrupt memory. It seems valid to add a range check here.
---
I can't test this.
drivers/infiniband/hw/ipath/ipath_verbs.c +4 -0
@@ -621,6 +621,10 @@ void ipath_ib_rcv(struct ipath_ibdev *dev, void *rhdr, void *data, } opcode =be32_to_cpu (ohdr->bth[0 ]) >>24 ; +if (opcode >=ARRAY_SIZE (dev->opstats)) { + dev->rcv_errors++; + goto bail; + } dev->opstats[opcode].n_bytes += tlen; dev->opstats[opcode].n_packets++;
A message that is not in the archive (sent off-list or not yet received): 20130312110307.GA22921-dZEljifmRObu9KfB+GxooP8+0UxHXcjY@public.gmane.org
Oddly, I don't see an issue with qib, which masks the opcode.
Would:
opcode = (be32_to_cpu(ohdr->bth[0]) >> 24) & 0x7f;
also correct the issue without adding the if test. At this point the hardware has already validated the opcode, so there is no value in the fail handling.
What args are you using with smatch?
Mike
Quoted 3 lines
My static checker complains that this could corrupt memory. It seems valid to add a range check here.
A message that is not in the archive (sent off-list or not yet received): 32E1700B9017364D9B60AED9960492BC0D5C926B-AtyAts71sc88Ug9VwtkbtrfspsVTdybXVpNB7YpNyf8@public.gmane.org
Quoted 11 lines · Mike
Oddly, I don't see an issue with qib, which masks the opcode.
Would:
opcode = (be32_to_cpu(ohdr->bth[0])>> 24) &0x7f;also correct the issue without adding the if test. At this point
the hardware has already validated the opcode, so there is no value in the fail handling.What args are you using with smatch?
Gar sorry, for the noise. You can just drop this then.
This is some custom stuff that probably has too many false positives to push.
Doing an "& 0x7f" would silence the warning but if this is validated by the hardware then we don't need it.
regards,
dan carpenter