Message ID | 20160922174858.31922-1-colin.king@canonical.com |
---|---|
State | Accepted, archived |
Delegated to: | David Miller |
Headers | show |
From: Colin King <colin.king@canonical.com> Date: Thu, 22 Sep 2016 18:48:58 +0100 > From: Colin Ian King <colin.king@canonical.com> > > Change predecrement compare to post decrement compare to avoid an > unsigned integer wrap-around comparison when decrementing idx in > the while loop. > > For example, when idx is zero, the current situation will > predecrement idx in the while loop, wrapping idx to the maximum > signed integer and cause out of bounds reads on rxq_info->msix_tbl[idx]. > > Signed-off-by: Colin Ian King <colin.king@canonical.com> Applied to net-next, thanks.
diff --git a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_uld.c b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_uld.c index d12a73e..42a9c8d 100644 --- a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_uld.c +++ b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_uld.c @@ -367,7 +367,7 @@ int request_msix_queue_irqs_uld(struct adapter *adap, unsigned int uld_type) } return 0; unwind: - while (--idx >= 0) { + while (idx-- > 0) { bmap_idx = rxq_info->msix_tbl[idx]; free_msix_idx_in_bmap(adap, bmap_idx); free_irq(adap->msix_info_ulds[bmap_idx].vec,