Skip to contentSkip to conversation

RDMA/ocrdma: off by one in ocrdma_query_gid()

PATCH Applied Dan Carpenter 3 participants 4 messages Jun 14, 2012 – Feb 17, 2015 1 message not in the archive

Subsystems (3)
Kernel janitors InfiniBand Emulex oneconnect RoCE driver
lore
Share & tools
lore

Dan Carpenter

author
#0 lore raw

PATCH 1/1 RDMA/ocrdma: off by one in ocrdma_query_gid()

The dev->sgid_tbl[] array is allocated in ocrdma_alloc_resources(). It has OCRDMA_MAX_SGID elements so the test here is off by one.

Signed-off-by Dan Carpenter <[email protected]>
drivers/infiniband/hw/ocrdma/ocrdma_verbs.c +1 -1
index d55d459..2e2e7ae 100644
@@ -53,7 +53,7 @@ int ocrdma_query_gid(struct ib_device *ibdev, u8 port,
 
 	dev = get_ocrdma_dev(ibdev);
 	memset(sgid, 0, sizeof(*sgid));
-	if (index > OCRDMA_MAX_SGID)
+	if (index >= OCRDMA_MAX_SGID)
 		return -EINVAL;
 
 	memcpy(sgid, &dev->sgid_tbl[index], sizeof(*sgid));

A message that is not in the archive (sent off-list or not yet received): [email protected]

author
#3 lore raw

PATCH 1/1 RDMA/ocrdma: off by one in ocrdma_query_gid()

In reply to Dan Carpenter

The ->sgid_tbl[] array has OCRDMA_MAX_SGID number of elements so this test is off by one. ->sgid_tbl is allocated in ocrdma_alloc_resources().

Signed-off-by Dan Carpenter <[email protected]>
drivers/infiniband/hw/ocrdma/ocrdma_verbs.c +1 -1
index fb8d8c4..18ea619 100644
@@ -53,7 +53,7 @@ int ocrdma_query_gid(struct ib_device *ibdev, u8 port,
 
 	dev = get_ocrdma_dev(ibdev);
 	memset(sgid, 0, sizeof(*sgid));
-	if (index > OCRDMA_MAX_SGID)
+	if (index >= OCRDMA_MAX_SGID)
 		return -EINVAL;
 
 	memcpy(sgid, &dev->sgid_tbl[index], sizeof(*sgid));
Acked-by on v1 1/1
#4 lore raw
Acked-by Selvin Xavier <[email protected]>

Thanks !

Quoted 27 lines

-----Original Message-----
From: Dan Carpenter [mailto:[email protected]]
Sent: Monday, February 16, 2015 3:32 PM
To: Roland Dreier
Cc: Sean Hefty; Hal Rosenstock; Devesh Sharma; Selvin Xavier; Mitesh Ahuja; Yishai Hadas; [email protected]; [email protected]
Subject: [patch] RDMA/ocrdma: off by one in ocrdma_query_gid()

The ->sgid_tbl[] array has OCRDMA_MAX_SGID number of elements so this test is off by one. ->sgid_tbl is allocated in ocrdma_alloc_resources().

Signed-off-by Dan Carpenter <[email protected]>
drivers/infiniband/hw/ocrdma/ocrdma_verbs.c +1 -1
index fb8d8c4..18ea619 100644
@@ -53,7 +53,7 @@ int ocrdma_query_gid(struct ib_device *ibdev, u8 port,
 
 	dev = get_ocrdma_dev(ibdev);
 	memset(sgid, 0, sizeof(*sgid));
-	if (index > OCRDMA_MAX_SGID)
+	if (index >= OCRDMA_MAX_SGID)
 		return -EINVAL;
 
 	memcpy(sgid, &dev->sgid_tbl[index], sizeof(*sgid));