| Message ID | 20120418065342.GC12831@elgon.mountain |
|---|---|
| State | Accepted, archived |
| Delegated to: | David Miller |
| Headers | show |
On Wed, 2012-04-18 at 09:53 +0300, Dan Carpenter wrote: > The sp_pri_to_cos[] array size depends on the config but lets say it is > BX_E3B0_MAX_NUM_COS_PORT0 and max_num_of_cos is also > DCBX_E3B0_MAX_NUM_COS_PORT0. In the original code > "pri == max_num_of_cos" was accepted but it is one past the end of the > array. > > Also we used "pri" before capping it. It's a harmless read past the end > of the array, but it would affect which error message gets printed. > > Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> > Acked-by: Eilon Greenstein <eilong@broadcom.com> Thanks Dan - this is obviously better. -- To unsubscribe from this list: send the line "unsubscribe netdev" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html
From: "Eilon Greenstein" <eilong@broadcom.com> Date: Wed, 18 Apr 2012 12:27:07 +0300 > On Wed, 2012-04-18 at 09:53 +0300, Dan Carpenter wrote: >> The sp_pri_to_cos[] array size depends on the config but lets say it is >> BX_E3B0_MAX_NUM_COS_PORT0 and max_num_of_cos is also >> DCBX_E3B0_MAX_NUM_COS_PORT0. In the original code >> "pri == max_num_of_cos" was accepted but it is one past the end of the >> array. >> >> Also we used "pri" before capping it. It's a harmless read past the end >> of the array, but it would affect which error message gets printed. >> >> Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> >> > > Acked-by: Eilon Greenstein <eilong@broadcom.com> Applied, thanks everyone. -- To unsubscribe from this list: send the line "unsubscribe netdev" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html
diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_link.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_link.c index ff882a4..6b21b21 100644 --- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_link.c +++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_link.c @@ -922,6 +922,12 @@ static int bnx2x_ets_e3b0_sp_pri_to_cos_set(const struct link_params *params, const u8 max_num_of_cos = (port) ? DCBX_E3B0_MAX_NUM_COS_PORT1 : DCBX_E3B0_MAX_NUM_COS_PORT0; + if (pri >= max_num_of_cos) { + DP(NETIF_MSG_LINK, "bnx2x_ets_e3b0_sp_pri_to_cos_set invalid " + "parameter Illegal strict priority\n"); + return -EINVAL; + } + if (sp_pri_to_cos[pri] != DCBX_INVALID_COS) { DP(NETIF_MSG_LINK, "bnx2x_ets_e3b0_sp_pri_to_cos_set invalid " "parameter There can't be two COS's with " @@ -929,12 +935,6 @@ static int bnx2x_ets_e3b0_sp_pri_to_cos_set(const struct link_params *params, return -EINVAL; } - if (pri > max_num_of_cos) { - DP(NETIF_MSG_LINK, "bnx2x_ets_e3b0_sp_pri_to_cos_set invalid " - "parameter Illegal strict priority\n"); - return -EINVAL; - } - sp_pri_to_cos[pri] = cos_entry; return 0;
The sp_pri_to_cos[] array size depends on the config but lets say it is BX_E3B0_MAX_NUM_COS_PORT0 and max_num_of_cos is also DCBX_E3B0_MAX_NUM_COS_PORT0. In the original code "pri == max_num_of_cos" was accepted but it is one past the end of the array. Also we used "pri" before capping it. It's a harmless read past the end of the array, but it would affect which error message gets printed. Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> -- To unsubscribe from this list: send the line "unsubscribe netdev" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html