[1/2] netxen: Correct off-by-one error in bounds check

After retrieving an Rx buffer index from the hardware, the netxen driver
bounds checks it against its array of receive buffers.  However in the case
of LRO packets, there's an off-by-one error in the check - it uses >
instead of the >= it uses for the normal receive path in
netxen_process_rcv().

Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
---
 drivers/net/ethernet/qlogic/netxen/netxen_nic_init.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

David,

You may also want to include fix for receive rings.

        if (unlikely(ring > adapter->max_rds_rings))
		return NULL;


Jiten

On 12/16/13 9:22 PM, "David Gibson" <david@gibson.dropbear.id.au> wrote:

>After retrieving an Rx buffer index from the hardware, the netxen driver
>bounds checks it against its array of receive buffers.  However in the
>case
>of LRO packets, there's an off-by-one error in the check - it uses >
>instead of the >= it uses for the normal receive path in
>netxen_process_rcv().
>
>Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
>---
> drivers/net/ethernet/qlogic/netxen/netxen_nic_init.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
>diff --git a/drivers/net/ethernet/qlogic/netxen/netxen_nic_init.c
>b/drivers/net/ethernet/qlogic/netxen/netxen_nic_init.c
>index 7692dfd..68658b8 100644
>--- a/drivers/net/ethernet/qlogic/netxen/netxen_nic_init.c
>+++ b/drivers/net/ethernet/qlogic/netxen/netxen_nic_init.c
>@@ -1610,7 +1610,7 @@ netxen_process_lro(struct netxen_adapter *adapter,
> 	rds_ring = &recv_ctx->rds_rings[ring];
> 
> 	index = netxen_get_lro_sts_refhandle(sts_data0);
>-	if (unlikely(index > rds_ring->num_desc))
>+	if (unlikely(index >= rds_ring->num_desc))
> 		return NULL;
> 
> 	buffer = &rds_ring->rx_buf_arr[index];
>-- 
>1.8.3.1
>
>--
>To unsubscribe from this list: send the line "unsubscribe netdev" in
>the body of a message to majordomo@vger.kernel.org
>More majordomo info at  http://vger.kernel.org/majordomo-info.html

--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html

>-----Original Message-----
>From: David Gibson [mailto:david@gibson.dropbear.id.au]
>Sent: Tuesday, December 17, 2013 10:53 AM
>To: Manish Chopra; Sony Chacko; Rajesh Borundia
>Cc: netdev; snagarka@redhat.com; tcamuso@redhat.com;
>vdasgupt@redhat.com; David Gibson
>Subject: [PATCH 1/2] netxen: Correct off-by-one error in bounds check
>
>After retrieving an Rx buffer index from the hardware, the netxen driver bounds
>checks it against its array of receive buffers.  However in the case of LRO packets,
>there's an off-by-one error in the check - it uses > instead of the >= it uses for the
>normal receive path in netxen_process_rcv().
>
>Signed-off-by: David Gibson <david@gibson.dropbear.id.au>

Acked-by: Manish Chopra <manish.chopra@qlogic.com>

Thanks David. This is really a bug fix. You can re-submit this single patch.


--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html

On Thu, Dec 19, 2013 at 11:51:37AM +0000, Manish Chopra wrote:
> >-----Original Message-----
> >From: David Gibson [mailto:david@gibson.dropbear.id.au]
> >Sent: Tuesday, December 17, 2013 10:53 AM
> >To: Manish Chopra; Sony Chacko; Rajesh Borundia
> >Cc: netdev; snagarka@redhat.com; tcamuso@redhat.com;
> >vdasgupt@redhat.com; David Gibson
> >Subject: [PATCH 1/2] netxen: Correct off-by-one error in bounds check
> >
> >After retrieving an Rx buffer index from the hardware, the netxen driver bounds
> >checks it against its array of receive buffers.  However in the case of LRO packets,
> >there's an off-by-one error in the check - it uses > instead of the >= it uses for the
> >normal receive path in netxen_process_rcv().
> >
> >Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
> 
> Acked-by: Manish Chopra <manish.chopra@qlogic.com>
> 
> Thanks David. This is really a bug fix. You can re-submit this single patch.

Ok, I added the extra fix Jiten suggested and resent.