From mboxrd@z Thu Jan 1 00:00:00 1970 From: Jason Gunthorpe Date: Wed, 13 Dec 2017 18:20:26 +0000 Subject: Re: RDMA/cxgb4: Add a sanity check in process_work() Message-Id: <20171213182026.GE5984@ziepe.ca> List-Id: References: <20171205143654.n5ybdhj3ga2tp7t4@mwanda> In-Reply-To: <20171205143654.n5ybdhj3ga2tp7t4@mwanda> MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit To: Dan Carpenter Cc: Steve Wise , Doug Ledford , linux-rdma-u79uwXL29TY76Z2rM5mHXA@public.gmane.org, kernel-janitors-u79uwXL29TY76Z2rM5mHXA@public.gmane.org On Tue, Dec 05, 2017 at 05:36:54PM +0300, Dan Carpenter wrote: > The story is that Smatch marks skb->data as untrusted so it generates > a warning message here: > > drivers/infiniband/hw/cxgb4/cm.c:4100 process_work() > error: buffer overflow 'work_handlers' 241 <= 255 > > In other places which handle this such as t4_uld_rx_handler() there is > some checking to make sure that the function pointer is not NULL. I > have added bounds checking and a check for NULL here as well. > > Signed-off-by: Dan Carpenter > Acked-by: Steve Wise Thanks, applied to -next Jason From mboxrd@z Thu Jan 1 00:00:00 1970 From: Jason Gunthorpe Subject: Re: RDMA/cxgb4: Add a sanity check in process_work() Date: Wed, 13 Dec 2017 11:20:26 -0700 Message-ID: <20171213182026.GE5984@ziepe.ca> References: <20171205143654.n5ybdhj3ga2tp7t4@mwanda> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Return-path: Content-Disposition: inline In-Reply-To: <20171205143654.n5ybdhj3ga2tp7t4@mwanda> Sender: linux-rdma-owner-u79uwXL29TY76Z2rM5mHXA@public.gmane.org To: Dan Carpenter Cc: Steve Wise , Doug Ledford , linux-rdma-u79uwXL29TY76Z2rM5mHXA@public.gmane.org, kernel-janitors-u79uwXL29TY76Z2rM5mHXA@public.gmane.org List-Id: linux-rdma@vger.kernel.org On Tue, Dec 05, 2017 at 05:36:54PM +0300, Dan Carpenter wrote: > The story is that Smatch marks skb->data as untrusted so it generates > a warning message here: > > drivers/infiniband/hw/cxgb4/cm.c:4100 process_work() > error: buffer overflow 'work_handlers' 241 <= 255 > > In other places which handle this such as t4_uld_rx_handler() there is > some checking to make sure that the function pointer is not NULL. I > have added bounds checking and a check for NULL here as well. > > Signed-off-by: Dan Carpenter > Acked-by: Steve Wise Thanks, applied to -next Jason -- To unsubscribe from this list: send the line "unsubscribe linux-rdma" in the body of a message to majordomo-u79uwXL29TY76Z2rM5mHXA@public.gmane.org More majordomo info at http://vger.kernel.org/majordomo-info.html