[patch] net/mlx4: off by one in parse_trans_rule()

Subsystems: mellanox mlx4 core vpi driver, networking drivers, the rest

STALE5167d

3 messages, 3 authors, 2012-07-17 · open the first message on its own page

[patch] net/mlx4: off by one in parse_trans_rule()

From: Dan Carpenter <hidden>
Date: 2012-07-11 06:33:56

This should be ">=" here instead of ">".  MLX4_NET_TRANS_RULE_NUM is 6.
We use "spec->id" as an array offset into the __rule_hw_sz[] and
__sw_id_hw[] arrays which have 6 elements.

Signed-off-by: Dan Carpenter <redacted>

diff --git a/drivers/net/ethernet/mellanox/mlx4/mcg.c b/drivers/net/ethernet/mellanox/mlx4/mcg.c
index bc62f53..5bac0df 100644
--- a/drivers/net/ethernet/mellanox/mlx4/mcg.c
+++ b/drivers/net/ethernet/mellanox/mlx4/mcg.c

@@ -773,7 +773,7 @@ static int parse_trans_rule(struct mlx4_dev *dev, struct mlx4_spec_list *spec,
 		[MLX4_NET_TRANS_RULE_ID_UDP] =
 			sizeof(struct mlx4_net_trans_rule_hw_tcp_udp)
 	};
-	if (spec->id > MLX4_NET_TRANS_RULE_NUM) {
+	if (spec->id >= MLX4_NET_TRANS_RULE_NUM) {
 		mlx4_err(dev, "Invalid network rule id. id = %d\n", spec->id);
 		return -EINVAL;
 	}

Re: [patch] net/mlx4: off by one in parse_trans_rule()

From: Hadar Hen Zion <hidden>
Date: 2012-07-11 14:54:39

On 7/11/2012 9:33 AM, Dan Carpenter wrote:

quoted hunk

This should be ">=" here instead of ">".  MLX4_NET_TRANS_RULE_NUM is 6.
We use "spec->id" as an array offset into the __rule_hw_sz[] and
__sw_id_hw[] arrays which have 6 elements.

Signed-off-by: Dan Carpenter <redacted>

diff --git a/drivers/net/ethernet/mellanox/mlx4/mcg.c b/drivers/net/ethernet/mellanox/mlx4/mcg.c
index bc62f53..5bac0df 100644
--- a/drivers/net/ethernet/mellanox/mlx4/mcg.c
+++ b/drivers/net/ethernet/mellanox/mlx4/mcg.c

@@ -773,7 +773,7 @@ static int parse_trans_rule(struct mlx4_dev *dev, struct mlx4_spec_list *spec,
  		[MLX4_NET_TRANS_RULE_ID_UDP] =
  			sizeof(struct mlx4_net_trans_rule_hw_tcp_udp)
  	};
-	if (spec->id > MLX4_NET_TRANS_RULE_NUM) {
+	if (spec->id >= MLX4_NET_TRANS_RULE_NUM) {
  		mlx4_err(dev, "Invalid network rule id. id = %d\n", spec->id);
  		return -EINVAL;
  	}

Hi Dan,

This is indeed a bug, thanks for spotting this over,

Please add:
Acked-by: Hadar Hen Zion <redacted>

Hadar

Re: [patch] net/mlx4: off by one in parse_trans_rule()

From: David Miller <davem@davemloft.net>
Date: 2012-07-17 05:58:49

From: Dan Carpenter <redacted>
Date: Wed, 11 Jul 2012 09:33:36 +0300

This should be ">=" here instead of ">".  MLX4_NET_TRANS_RULE_NUM is 6.
We use "spec->id" as an array offset into the __rule_hw_sz[] and
__sw_id_hw[] arrays which have 6 elements.

Signed-off-by: Dan Carpenter <redacted>

Applied, thanks.

Dan, in the future please indicate clearly that your patches are
targetted at net-next specifically.  Thanks.

`h`	back out one level
`j`	next message in thread
`k`	previous message in thread
`l`	drill in
`Esc`	close help / fold thread tree
`?`	toggle this help