From: Dan Carpenter <dan.carpenter@oracle.com>
To: Greg Kroah-Hartman <gregkh@linuxfoundation.org>, htejun@gmail.com
Cc: Catalin Marinas <catalin.marinas@arm.com>,
Cristian Stoica <cristian.stoica@freescale.com>,
Dan Williams <dan.j.williams@intel.com>,
Abhilash Kesavan <a.kesavan@samsung.com>,
linux-kernel@vger.kernel.org, kernel-janitors@vger.kernel.org
Subject: [patch] devres: fix a for loop bounds check
Date: Mon, 21 Sep 2015 16:21:51 +0000 [thread overview]
Message-ID: <20150921162151.GA5648@mwanda> (raw)
In-Reply-To: <20150916171000.GD3243@mtj.duckdns.org>
The iomap[] array has PCIM_IOMAP_MAX (6) elements and not
DEVICE_COUNT_RESOURCE (16). This bug was found using a static checker.
It may be that the "if (!(mask & (1 << i)))" check means we never
actually go past the end of the array in real life.
Fixes: ec04b075843d ('iomap: implement pcim_iounmap_regions()')
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
diff --git a/lib/devres.c b/lib/devres.c
index f13a246..8c85672 100644
--- a/lib/devres.c
+++ b/lib/devres.c
@@ -418,7 +418,7 @@ void pcim_iounmap_regions(struct pci_dev *pdev, int mask)
if (!iomap)
return;
- for (i = 0; i < DEVICE_COUNT_RESOURCE; i++) {
+ for (i = 0; i < PCIM_IOMAP_MAX; i++) {
if (!(mask & (1 << i)))
continue;
WARNING: multiple messages have this Message-ID (diff)
From: Dan Carpenter <dan.carpenter@oracle.com>
To: Greg Kroah-Hartman <gregkh@linuxfoundation.org>, htejun@gmail.com
Cc: Catalin Marinas <catalin.marinas@arm.com>,
Cristian Stoica <cristian.stoica@freescale.com>,
Dan Williams <dan.j.williams@intel.com>,
Abhilash Kesavan <a.kesavan@samsung.com>,
linux-kernel@vger.kernel.org, kernel-janitors@vger.kernel.org
Subject: [patch] devres: fix a for loop bounds check
Date: Mon, 21 Sep 2015 19:21:51 +0300 [thread overview]
Message-ID: <20150921162151.GA5648@mwanda> (raw)
In-Reply-To: <20150916171000.GD3243@mtj.duckdns.org>
The iomap[] array has PCIM_IOMAP_MAX (6) elements and not
DEVICE_COUNT_RESOURCE (16). This bug was found using a static checker.
It may be that the "if (!(mask & (1 << i)))" check means we never
actually go past the end of the array in real life.
Fixes: ec04b075843d ('iomap: implement pcim_iounmap_regions()')
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
diff --git a/lib/devres.c b/lib/devres.c
index f13a246..8c85672 100644
--- a/lib/devres.c
+++ b/lib/devres.c
@@ -418,7 +418,7 @@ void pcim_iounmap_regions(struct pci_dev *pdev, int mask)
if (!iomap)
return;
- for (i = 0; i < DEVICE_COUNT_RESOURCE; i++) {
+ for (i = 0; i < PCIM_IOMAP_MAX; i++) {
if (!(mask & (1 << i)))
continue;
next prev parent reply other threads:[~2015-09-21 16:21 UTC|newest]
Thread overview: 7+ messages / expand[flat|nested] mbox.gz Atom feed top
2015-09-16 16:00 iomap: implement pcim_iounmap_regions() Dan Carpenter
2015-09-16 17:10 ` Tejun Heo
2015-09-21 16:21 ` Dan Carpenter [this message]
2015-09-21 16:21 ` [patch] devres: fix a for loop bounds check Dan Carpenter
2015-09-21 17:40 ` Tejun Heo
2015-09-21 17:40 ` Tejun Heo
2015-09-16 18:14 ` iomap: implement pcim_iounmap_regions() Dan Carpenter
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20150921162151.GA5648@mwanda \
--to=dan.carpenter@oracle.com \
--cc=a.kesavan@samsung.com \
--cc=catalin.marinas@arm.com \
--cc=cristian.stoica@freescale.com \
--cc=dan.j.williams@intel.com \
--cc=gregkh@linuxfoundation.org \
--cc=htejun@gmail.com \
--cc=kernel-janitors@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.