diff mbox series

[7/7] hw/rdma: Fix possible out of bounds access to port GID index

Message ID 20180430200223.4119-8-marcel.apfelbaum@gmail.com
State New
Headers show
Series hw/rdma: coverity fixes | expand

Commit Message

Marcel Apfelbaum April 30, 2018, 8:02 p.m. UTC 
Make sure the backend GID index is less then port's
git table length.

Signed-off-by: Marcel Apfelbaum <marcel.apfelbaum@gmail.com>
Reviewed-by: Yuval Shaia <yuval.shaia@oracle.com>
---
 hw/rdma/rdma_backend.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

Comments

Eric Blake April 30, 2018, 9:14 p.m. UTC | #1 
On 04/30/2018 03:02 PM, Marcel Apfelbaum wrote:
> Make sure the backend GID index is less then port's
> git table length.

s/git/gid/

> 
> Signed-off-by: Marcel Apfelbaum <marcel.apfelbaum@gmail.com>
> Reviewed-by: Yuval Shaia <yuval.shaia@oracle.com>
> ---
>   hw/rdma/rdma_backend.c | 2 +-
>   1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/hw/rdma/rdma_backend.c b/hw/rdma/rdma_backend.c
> index 5c7b3d8949..e9ced6f9ef 100644
> --- a/hw/rdma/rdma_backend.c
> +++ b/hw/rdma/rdma_backend.c
> @@ -774,7 +774,7 @@ int rdma_backend_init(RdmaBackendDev *backend_dev,
>           goto out_destroy_comm_channel;
>       }
>   
> -    if (backend_dev->backend_gid_idx > port_attr.gid_tbl_len) {
> +    if (backend_dev->backend_gid_idx >= port_attr.gid_tbl_len) {
>           error_setg(errp, "Invalid backend_gid_idx, should be less than %d",
>                      port_attr.gid_tbl_len);
>           goto out_destroy_comm_channel;
>
Marcel Apfelbaum May 1, 2018, 8:58 a.m. UTC | #2 
On 05/01/2018 12:14 AM, Eric Blake wrote:
> On 04/30/2018 03:02 PM, Marcel Apfelbaum wrote:
>> Make sure the backend GID index is less then port's
>> git table length.
>
> s/git/gid/
>

Thanks, I will fix in the pull request
Marcel

>>
>> Signed-off-by: Marcel Apfelbaum <marcel.apfelbaum@gmail.com>
>> Reviewed-by: Yuval Shaia <yuval.shaia@oracle.com>
>> ---
>>   hw/rdma/rdma_backend.c | 2 +-
>>   1 file changed, 1 insertion(+), 1 deletion(-)
>>
>> diff --git a/hw/rdma/rdma_backend.c b/hw/rdma/rdma_backend.c
>> index 5c7b3d8949..e9ced6f9ef 100644
>> --- a/hw/rdma/rdma_backend.c
>> +++ b/hw/rdma/rdma_backend.c
>> @@ -774,7 +774,7 @@ int rdma_backend_init(RdmaBackendDev *backend_dev,
>>           goto out_destroy_comm_channel;
>>       }
>>   -    if (backend_dev->backend_gid_idx > port_attr.gid_tbl_len) {
>> +    if (backend_dev->backend_gid_idx >= port_attr.gid_tbl_len) {
>>           error_setg(errp, "Invalid backend_gid_idx, should be less 
>> than %d",
>>                      port_attr.gid_tbl_len);
>>           goto out_destroy_comm_channel;
>>
>
diff mbox series

Patch

diff --git a/hw/rdma/rdma_backend.c b/hw/rdma/rdma_backend.c
index 5c7b3d8949..e9ced6f9ef 100644
--- a/hw/rdma/rdma_backend.c
+++ b/hw/rdma/rdma_backend.c
@@ -774,7 +774,7 @@  int rdma_backend_init(RdmaBackendDev *backend_dev,
         goto out_destroy_comm_channel;
     }
 
-    if (backend_dev->backend_gid_idx > port_attr.gid_tbl_len) {
+    if (backend_dev->backend_gid_idx >= port_attr.gid_tbl_len) {
         error_setg(errp, "Invalid backend_gid_idx, should be less than %d",
                    port_attr.gid_tbl_len);
         goto out_destroy_comm_channel;