linux-kernel - RE: [EXT] [PATCH] bnx2x: Fix potential infinite loop

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:   Thu, 8 Apr 2021 01:44:23 +0000
From:   Sudarsana Reddy Kalluru <skalluru@...vell.com>
To:     Colin King <colin.king@...onical.com>,
        Ariel Elior <aelior@...vell.com>,
        GR-everest-linux-l2 <GR-everest-linux-l2@...vell.com>,
        "David S . Miller" <davem@...emloft.net>,
        Jakub Kicinski <kuba@...nel.org>,
        Eilon Greenstein <eilong@...adcom.com>,
        "netdev@...r.kernel.org" <netdev@...r.kernel.org>
CC:     "kernel-janitors@...r.kernel.org" <kernel-janitors@...r.kernel.org>,
        "linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>
Subject: RE: [EXT] [PATCH] bnx2x: Fix potential infinite loop


> -----Original Message-----
> From: Colin King <colin.king@...onical.com>
> Sent: Wednesday, April 7, 2021 7:58 PM
> To: Ariel Elior <aelior@...vell.com>; Sudarsana Reddy Kalluru
> <skalluru@...vell.com>; GR-everest-linux-l2 <GR-everest-linux-
> l2@...vell.com>; David S . Miller <davem@...emloft.net>; Jakub Kicinski
> <kuba@...nel.org>; Eilon Greenstein <eilong@...adcom.com>;
> netdev@...r.kernel.org
> Cc: kernel-janitors@...r.kernel.org; linux-kernel@...r.kernel.org
> Subject: [EXT] [PATCH] bnx2x: Fix potential infinite loop
> 
> External Email
> 
> ----------------------------------------------------------------------
> From: Colin Ian King <colin.king@...onical.com>
> 
> The for_each_tx_queue loop iterates with a u8 loop counter i and compares
> this with the loop upper limit of bp->num_queues that is an int type.  There
> is a potential infinite loop if bp->num_queues is larger than the u8 loop
> counter. Fix this by making the loop counter the same type as bp-
> >num_queues.
> 
> Addresses-Coverity: ("Infinite loop")
> Fixes: ad5afc89365e ("bnx2x: Separate VF and PF logic")
> Signed-off-by: Colin Ian King <colin.king@...onical.com>
> ---
>  drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c | 3 ++-
>  1 file changed, 2 insertions(+), 1 deletion(-)
> 
> diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c
> b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c
> index 1a6ec1a12d53..edfbeb710ad4 100644
> --- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c
> +++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c
> @@ -2959,7 +2959,8 @@ int bnx2x_nic_load(struct bnx2x *bp, int
> load_mode)
> 
>  int bnx2x_drain_tx_queues(struct bnx2x *bp)  {
> -	u8 rc = 0, cos, i;
> +	u8 rc = 0, cos;
> +	int i;
> 
>  	/* Wait until tx fastpath tasks complete */
>  	for_each_tx_queue(bp, i) {
> --
> 2.30.2

Thanks for the change. [just for the info, theoretical max num_queues value for bnx2x device is 33]

Acked-by: Sudarsana Reddy Kalluru <skalluru@...vell.com>