[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Message-ID: <20230717192403.96187-1-kuniyu@amazon.com>
Date: Mon, 17 Jul 2023 12:24:03 -0700
From: Kuniyuki Iwashima <kuniyu@...zon.com>
To: <carlos.bilbao@....com>
CC: <davem@...emloft.net>, <edumazet@...gle.com>, <kuba@...nel.org>,
<linux-kernel@...r.kernel.org>, <mchan@...adcom.com>,
<netdev@...r.kernel.org>, <pabeni@...hat.com>,
<prashant@...adcom.com>, <siva.kallam@...adcom.com>,
<kuniyu@...zon.com>
Subject: Re: [PATCH] tg3: fix array subscript out of bounds compilation error
From: Carlos Bilbao <carlos.bilbao@....com>
Date: Mon, 17 Jul 2023 09:34:43 -0500
> Fix encountered compilation error in tg3.c where an array subscript was
What is the error ?
> above the array bounds of 'struct tg3_napi[5]'. Add an additional check in
> the for loop to ensure that it does not exceed the bounds of
> 'struct tg3_napi' (defined by TG3_IRQ_MAX_VECS).
>
> Reviewed-By: Carlos Bilbao <carlos.bilbao@....com>
> ---
> drivers/net/ethernet/broadcom/tg3.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/drivers/net/ethernet/broadcom/tg3.c b/drivers/net/ethernet/broadcom/tg3.c
> index 4179a12fc881..33ad75b7ed91 100644
> --- a/drivers/net/ethernet/broadcom/tg3.c
> +++ b/drivers/net/ethernet/broadcom/tg3.c
> @@ -17791,7 +17791,7 @@ static int tg3_init_one(struct pci_dev *pdev,
> intmbx = MAILBOX_INTERRUPT_0 + TG3_64BIT_REG_LOW;
> rcvmbx = MAILBOX_RCVRET_CON_IDX_0 + TG3_64BIT_REG_LOW;
> sndmbx = MAILBOX_SNDHOST_PROD_IDX_0 + TG3_64BIT_REG_LOW;
> - for (i = 0; i < tp->irq_max; i++) {
> + for (i = 0; i < tp->irq_max && i < TG3_IRQ_MAX_VECS; i++) {
I'm not familiar with this driver, but it seem tg3_init_one() calls
tg3_get_invariants() before the loop and initialises irq_max as 1
or TG3_IRQ_MAX_VECS.
Where does tp->irq_max go over TG3_IRQ_MAX_VECS ?
> struct tg3_napi *tnapi = &tp->napi[i];
>
> tnapi->tp = tp;
> --
> 2.41.0
Powered by blists - more mailing lists