Skip to contentSkip to conversation

scsi: cxgb4i: silence overflow warning in t4_uld_rx_handler()

PATCH Applied Dan Carpenter 2 participants 2 messages Apr 3, 2018 – Apr 10, 2018

Subsystems (3)
SCSI Kernel janitors CXGB4 iSCSI driver (CXGB4I)
lore
Share & tools
lore

Dan Carpenter

author
#0 lore raw

PATCH v2 1/1 scsi: cxgb4i: silence overflow warning in t4_uld_rx_handler()

Smatch marks skb->data as untrusted so it complains that there is a potential overflow here:

	drivers/scsi/cxgbi/cxgb4i/cxgb4i.c:2111 t4_uld_rx_handler()
	error: buffer overflow 'cxgb4i_cplhandlers' 239 <= 255.

In this case, skb->data comes from the hardware or firmware so it's not going to overflow unless there is a firmware bug.

Signed-off-by Dan Carpenter <[email protected]>

---
v2: rebase, and re-write commit message

drivers/scsi/cxgbi/cxgb4i/cxgb4i.c +3 -3
index 406e94312d4e..beb146b7c17c 100644
@@ -2108,11 +2108,11 @@ static int t4_uld_rx_handler(void *handle, const __be64 *rsp,
 	log_debug(1 << CXGBI_DBG_TOE,
 		"cdev %p, opcode 0x%x(0x%x,0x%x), skb %p.\n",
 		 cdev, opc, rpl->ot.opcode_tid, ntohl(rpl->ot.opcode_tid), skb);
-	if (cxgb4i_cplhandlers[opc])
-		cxgb4i_cplhandlers[opc](cdev, skb);
-	else {
+	if (opc >= ARRAY_SIZE(cxgb4i_cplhandlers) || !cxgb4i_cplhandlers[opc]) {
 		pr_err("No handler for opcode 0x%x.\n", opc);
 		__kfree_skb(skb);
+	} else {
+		cxgb4i_cplhandlers[opc](cdev, skb);
 	}
 	return 0;
 nomem:
Applied
#1 lore raw

Dan,

Quoted 8 lines

Smatch marks skb->data as untrusted so it complains that there is a potential overflow here:

	drivers/scsi/cxgbi/cxgb4i/cxgb4i.c:2111 t4_uld_rx_handler()
	error: buffer overflow 'cxgb4i_cplhandlers' 239 <= 255.

In this case, skb->data comes from the hardware or firmware so it's not going to overflow unless there is a firmware bug.

Applied to 4.17/scsi-fixes, thanks!

Signature · 1 line
Martin K. Petersen	Oracle Linux Engineering