| Message ID | 20190802155217.16996-1-colin.king@canonical.com |
|---|---|
| State | Accepted |
| Delegated to: | Jeff Kirsher |
| Headers | show |
| Series | [net-next] ice: fix potential infinite loop | expand |
> -----Original Message----- > From: Intel-wired-lan [mailto:intel-wired-lan-bounces@osuosl.org] On Behalf > Of Colin King > Sent: Friday, August 02, 2019 8:52 AM > To: Kirsher, Jeffrey T <jeffrey.t.kirsher@intel.com>; David S . Miller > <davem@davemloft.net>; intel-wired-lan@lists.osuosl.org; > netdev@vger.kernel.org > Cc: kernel-janitors@vger.kernel.org; linux-kernel@vger.kernel.org > Subject: [Intel-wired-lan] [PATCH][net-next] ice: fix potential infinite loop > > From: Colin Ian King <colin.king@canonical.com> > > The loop counter of a for-loop is a u8 however this is being compared > to an int upper bound and this can lead to an infinite loop if the > upper bound is greater than 255 since the loop counter will wrap back > to zero. Fix this potential issue by making the loop counter an int. > > Addresses-Coverity: ("Infinite loop") Actually, num_alloc_vfs should probably be a u16 instead of an int since num_alloc_vfs cannot exceed 256. Which Coverity scan reported this and what options are used in the analysis? > Fixes: c7aeb4d1b9bf ("ice: Disable VFs until reset is completed") > Signed-off-by: Colin Ian King <colin.king@canonical.com> > --- > drivers/net/ethernet/intel/ice/ice_main.c | 2 +- > 1 file changed, 1 insertion(+), 1 deletion(-) > > diff --git a/drivers/net/ethernet/intel/ice/ice_main.c > b/drivers/net/ethernet/intel/ice/ice_main.c > index c26e6a102dac..088543d50095 100644 > --- a/drivers/net/ethernet/intel/ice/ice_main.c > +++ b/drivers/net/ethernet/intel/ice/ice_main.c > @@ -488,7 +488,7 @@ static void > ice_prepare_for_reset(struct ice_pf *pf) > { > struct ice_hw *hw = &pf->hw; > - u8 i; > + int i; > > /* already prepared for reset */ > if (test_bit(__ICE_PREPARED_FOR_RESET, pf->state)) > -- > 2.20.1 > > _______________________________________________ > Intel-wired-lan mailing list > Intel-wired-lan@osuosl.org > https://lists.osuosl.org/mailman/listinfo/intel-wired-lan
On 02/08/2019 18:07, Allan, Bruce W wrote: >> -----Original Message----- >> From: Intel-wired-lan [mailto:intel-wired-lan-bounces@osuosl.org] On Behalf >> Of Colin King >> Sent: Friday, August 02, 2019 8:52 AM >> To: Kirsher, Jeffrey T <jeffrey.t.kirsher@intel.com>; David S . Miller >> <davem@davemloft.net>; intel-wired-lan@lists.osuosl.org; >> netdev@vger.kernel.org >> Cc: kernel-janitors@vger.kernel.org; linux-kernel@vger.kernel.org >> Subject: [Intel-wired-lan] [PATCH][net-next] ice: fix potential infinite loop >> >> From: Colin Ian King <colin.king@canonical.com> >> >> The loop counter of a for-loop is a u8 however this is being compared >> to an int upper bound and this can lead to an infinite loop if the >> upper bound is greater than 255 since the loop counter will wrap back >> to zero. Fix this potential issue by making the loop counter an int. >> >> Addresses-Coverity: ("Infinite loop") > > Actually, num_alloc_vfs should probably be a u16 instead of an int since num_alloc_vfs cannot exceed 256. > > Which Coverity scan reported this and what options are used in the analysis? One that I run in a private coverity scan with scan analysis cranked up high on linux-next, so the report is not public. Colin > >> Fixes: c7aeb4d1b9bf ("ice: Disable VFs until reset is completed") >> Signed-off-by: Colin Ian King <colin.king@canonical.com> >> --- >> drivers/net/ethernet/intel/ice/ice_main.c | 2 +- >> 1 file changed, 1 insertion(+), 1 deletion(-) >> >> diff --git a/drivers/net/ethernet/intel/ice/ice_main.c >> b/drivers/net/ethernet/intel/ice/ice_main.c >> index c26e6a102dac..088543d50095 100644 >> --- a/drivers/net/ethernet/intel/ice/ice_main.c >> +++ b/drivers/net/ethernet/intel/ice/ice_main.c >> @@ -488,7 +488,7 @@ static void >> ice_prepare_for_reset(struct ice_pf *pf) >> { >> struct ice_hw *hw = &pf->hw; >> - u8 i; >> + int i; >> >> /* already prepared for reset */ >> if (test_bit(__ICE_PREPARED_FOR_RESET, pf->state)) >> -- >> 2.20.1 >> >> _______________________________________________ >> Intel-wired-lan mailing list >> Intel-wired-lan@osuosl.org >> https://lists.osuosl.org/mailman/listinfo/intel-wired-lan
> -----Original Message----- > From: Intel-wired-lan [mailto:intel-wired-lan-bounces@osuosl.org] On > Behalf Of Colin King > Sent: Friday, August 2, 2019 8:52 AM > To: Kirsher, Jeffrey T <jeffrey.t.kirsher@intel.com>; David S . Miller > <davem@davemloft.net>; intel-wired-lan@lists.osuosl.org; > netdev@vger.kernel.org > Cc: kernel-janitors@vger.kernel.org; linux-kernel@vger.kernel.org > Subject: [Intel-wired-lan] [PATCH][net-next] ice: fix potential infinite loop > > From: Colin Ian King <colin.king@canonical.com> > > The loop counter of a for-loop is a u8 however this is being compared to an > int upper bound and this can lead to an infinite loop if the upper bound is > greater than 255 since the loop counter will wrap back to zero. Fix this > potential issue by making the loop counter an int. > > Addresses-Coverity: ("Infinite loop") > Fixes: c7aeb4d1b9bf ("ice: Disable VFs until reset is completed") > Signed-off-by: Colin Ian King <colin.king@canonical.com> > --- > drivers/net/ethernet/intel/ice/ice_main.c | 2 +- > 1 file changed, 1 insertion(+), 1 deletion(-) Tested-by: Andrew Bowers <andrewx.bowers@intel.com>
diff --git a/drivers/net/ethernet/intel/ice/ice_main.c b/drivers/net/ethernet/intel/ice/ice_main.c index c26e6a102dac..088543d50095 100644 --- a/drivers/net/ethernet/intel/ice/ice_main.c +++ b/drivers/net/ethernet/intel/ice/ice_main.c @@ -488,7 +488,7 @@ static void ice_prepare_for_reset(struct ice_pf *pf) { struct ice_hw *hw = &pf->hw; - u8 i; + int i; /* already prepared for reset */ if (test_bit(__ICE_PREPARED_FOR_RESET, pf->state))