From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: linux-kernel@vger.kernel.org
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
stable@vger.kernel.org, Dan Carpenter <dan.carpenter@oracle.com>,
Jon Mason <jon.mason@intel.com>
Subject: [ 12/21] ntb: off by one sanity checks
Date: Wed, 22 May 2013 15:10:30 -0700 [thread overview]
Message-ID: <20130522205234.047146670@linuxfoundation.org> (raw)
In-Reply-To: <20130522205232.597066680@linuxfoundation.org>
3.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dan Carpenter <dan.carpenter@oracle.com>
commit ad3e2751e7c546ae678be1f8d86e898506b42cef upstream.
These tests are off by one. If "mw" is equal to NTB_NUM_MW then we
would go beyond the end of the ndev->mw[] array.
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Jon Mason <jon.mason@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/ntb/ntb_hw.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
--- a/drivers/ntb/ntb_hw.c
+++ b/drivers/ntb/ntb_hw.c
@@ -345,7 +345,7 @@ int ntb_read_remote_spad(struct ntb_devi
*/
void __iomem *ntb_get_mw_vbase(struct ntb_device *ndev, unsigned int mw)
{
- if (mw > NTB_NUM_MW)
+ if (mw >= NTB_NUM_MW)
return NULL;
return ndev->mw[mw].vbase;
@@ -362,7 +362,7 @@ void __iomem *ntb_get_mw_vbase(struct nt
*/
resource_size_t ntb_get_mw_size(struct ntb_device *ndev, unsigned int mw)
{
- if (mw > NTB_NUM_MW)
+ if (mw >= NTB_NUM_MW)
return 0;
return ndev->mw[mw].bar_sz;
@@ -380,7 +380,7 @@ resource_size_t ntb_get_mw_size(struct n
*/
void ntb_set_mw_addr(struct ntb_device *ndev, unsigned int mw, u64 addr)
{
- if (mw > NTB_NUM_MW)
+ if (mw >= NTB_NUM_MW)
return;
dev_dbg(&ndev->pdev->dev, "Writing addr %Lx to BAR %d\n", addr,
next prev parent reply other threads:[~2013-05-22 22:10 UTC|newest]
Thread overview: 27+ messages / expand[flat|nested] mbox.gz Atom feed top
2013-05-22 22:10 [ 00/21] 3.9.4-stable review Greg Kroah-Hartman
2013-05-22 22:10 ` [ 01/21] arm64: debug: clear mdscr_el1 instead of taking the OS lock Greg Kroah-Hartman
2013-05-22 22:10 ` [ 02/21] arm64: mm: Fix operands of clz in __flush_dcache_all Greg Kroah-Hartman
2013-05-22 22:10 ` [ 03/21] btrfs: dont stop searching after encountering the wrong item Greg Kroah-Hartman
2013-05-22 22:10 ` [ 04/21] hwmon: fix error return code in abituguru_probe() Greg Kroah-Hartman
2013-05-22 22:10 ` [ 05/21] i2c: designware: fix RX FIFO overrun Greg Kroah-Hartman
2013-05-22 22:10 ` [ 06/21] i2c: designware: always clear interrupts before enabling them Greg Kroah-Hartman
2013-05-22 22:10 ` [ 07/21] x86: Fix bit corruption at CPU resume time Greg Kroah-Hartman
2013-05-22 22:10 ` [ 08/21] drm/nouveau/bios: fix thinko in ZM_MASK_ADD opcode Greg Kroah-Hartman
2013-05-22 22:10 ` [ 09/21] drm/radeon: Fix VRAM size calculation for VRAM >= 4GB Greg Kroah-Hartman
2013-05-22 22:10 ` [ 10/21] virtio_console: fix uapi header Greg Kroah-Hartman
2013-05-22 22:10 ` [ 11/21] NTB: variable dereferenced before check Greg Kroah-Hartman
2013-05-22 22:10 ` Greg Kroah-Hartman [this message]
2013-05-22 22:10 ` [ 13/21] NTB: fix pointer math issues Greg Kroah-Hartman
2013-05-22 22:10 ` [ 14/21] NTB: Handle 64bit BAR sizes Greg Kroah-Hartman
2013-05-22 22:10 ` [ 15/21] NTB: Link toggle memory leak Greg Kroah-Hartman
2013-05-22 22:10 ` [ 16/21] NTB: reset tx_index on link toggle Greg Kroah-Hartman
2013-05-22 22:10 ` [ 17/21] NTB: Correctly handle receive buffers of the minimal size Greg Kroah-Hartman
2013-05-22 22:10 ` [ 18/21] NTB: memcpy lockup workaround Greg Kroah-Hartman
2013-05-22 22:10 ` [ 19/21] ntb_netdev: remove from list on exit Greg Kroah-Hartman
2013-05-22 22:10 ` [ 20/21] NTB: Multiple NTB client fix Greg Kroah-Hartman
2013-05-22 22:10 ` [ 21/21] x86, vm86: fix VM86 syscalls: use SYSCALL_DEFINEx(...) Greg Kroah-Hartman
2013-05-24 11:13 ` Satoru Takeuchi
2013-05-23 16:52 ` [ 00/21] 3.9.4-stable review Shuah Khan
2013-05-23 16:52 ` Shuah Khan
2013-05-23 16:57 ` Greg Kroah-Hartman
2013-05-24 11:46 ` Satoru Takeuchi
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20130522205234.047146670@linuxfoundation.org \
--to=gregkh@linuxfoundation.org \
--cc=dan.carpenter@oracle.com \
--cc=jon.mason@intel.com \
--cc=linux-kernel@vger.kernel.org \
--cc=stable@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.