Skip to contentSkip to conversation

crypto: qat - silence a static checker warning

PATCH Applied Dan Carpenter 3 participants 3 messages Aug 21, 2015 – Aug 24, 2015

Subsystems (2)
Kernel janitors Crypto API
lore
Share & tools
lore

Dan Carpenter

author
#0 lore raw

PATCH 1/1 crypto: qat - silence a static checker warning

My static checker assumes that if we are getting numbers as a string using kstrotoint() then that means they come from outside the kernel and are untrustworthy.

This may or may not be true in this case, but it seems harmless to add a range check here.

Signed-off-by Dan Carpenter <[email protected]>
drivers/crypto/qat/qat_common/adf_transport.c +4 -0
index d5d8198..ec3abf9 100644
@@ -264,6 +264,10 @@ int adf_create_ring(struct adf_accel_dev *accel_dev, const char *section,
 		dev_err(&GET_DEV(accel_dev), "Can't get ring number\n");
 		return -EFAULT;
 	}
+	if (ring_num >= ARRAY_SIZE(bank->rings)) {
+		dev_err(&GET_DEV(accel_dev), "Invalid ring number\n");
+		return -EFAULT;
+	}
 
 	bank = &transport_data->banks[bank_num];
 	if (adf_reserve_ring(bank, ring_num)) {
#1 lore raw

Hi Dan,

Quoted 15 lines · Dan Carpenter

My static checker assumes that if we are getting numbers as a string using kstrotoint() then that means they come from outside the kernel and are untrustworthy.

This may or may not be true in this case, but it seems harmless to add a range check here.

Signed-off-by Dan Carpenter <[email protected]>
drivers/crypto/qat/qat_common/adf_transport.c +0 -0
index d5d8198..ec3abf9 100644

drivers/crypto/qat/qat_common/adf_transport.c int adf_create_ring(struct adf_accel_dev *accel_dev, const char *section, · line 273

Quoted 10 lines
drivers/crypto/qat/qat_common/adf_transport.c +4 -0
@@ -264,6 +264,10 @@ int adf_create_ring(struct adf_accel_dev *accel_dev, const char *section,
 		dev_err(&GET_DEV(accel_dev), "Can't get ring number\n");
 		return -EFAULT;
 	}
+	if (ring_num >= ARRAY_SIZE(bank->rings)) {
+		dev_err(&GET_DEV(accel_dev), "Invalid ring number\n");
+		return -EFAULT;
+	}
 
 	bank = &transport_data->banks[bank_num];
 	if (adf_reserve_ring(bank, ring_num)) {

ACK, although I would use the ADF_ETR_MAX_RINGS_PER_BANK define. So if you don't mind.
Thanks!
---8<---

Add range check for ring number.

Reported-by Dan Carpenter <[email protected]>
Signed-off-by Tadeusz Struk <[email protected]>
drivers/crypto/qat/qat_common/adf_transport.c +4 -0
index d5d8198..3865ae8 100644
@@ -264,6 +264,10 @@ int adf_create_ring(struct adf_accel_dev *accel_dev, const char *section,
 		dev_err(&GET_DEV(accel_dev), "Can't get ring number\n");
 		return -EFAULT;
 	}
+	if (ring_num >= ADF_ETR_MAX_RINGS_PER_BANK) {
+		dev_err(&GET_DEV(accel_dev), "Invalid ring number\n");
+		return -EFAULT;
+	}
 
 	bank = &transport_data->banks[bank_num];
 	if (adf_reserve_ring(bank, ring_num)) {