* [PATCH] RDMA/cxgb4: Add a sanity check in process_work()
@ 2017-12-05 14:36 Dan Carpenter
2017-12-05 15:05 ` Steve Wise
2017-12-13 18:20 ` Jason Gunthorpe
0 siblings, 2 replies; 3+ messages in thread
From: Dan Carpenter @ 2017-12-05 14:36 UTC (permalink / raw)
To: Steve Wise
Cc: Doug Ledford, Jason Gunthorpe, linux-rdma-u79uwXL29TY76Z2rM5mHXA,
kernel-janitors-u79uwXL29TY76Z2rM5mHXA
The story is that Smatch marks skb->data as untrusted so it generates
a warning message here:
drivers/infiniband/hw/cxgb4/cm.c:4100 process_work()
error: buffer overflow 'work_handlers' 241 <= 255
In other places which handle this such as t4_uld_rx_handler() there is
some checking to make sure that the function pointer is not NULL. I
have added bounds checking and a check for NULL here as well.
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
diff --git a/drivers/infiniband/hw/cxgb4/cm.c b/drivers/infiniband/hw/cxgb4/cm.c
index 21db3b48a617..844c9e78df8b 100644
--- a/drivers/infiniband/hw/cxgb4/cm.c
+++ b/drivers/infiniband/hw/cxgb4/cm.c
@@ -4097,9 +4097,15 @@ static void process_work(struct work_struct *work)
dev = *((struct c4iw_dev **) (skb->cb + sizeof(void *)));
opcode = rpl->ot.opcode;
- ret = work_handlers[opcode](dev, skb);
- if (!ret)
+ if (opcode >= ARRAY_SIZE(work_handlers) ||
+ !work_handlers[opcode]) {
+ pr_err("No handler for opcode 0x%x.\n", opcode);
kfree_skb(skb);
+ } else {
+ ret = work_handlers[opcode](dev, skb);
+ if (!ret)
+ kfree_skb(skb);
+ }
process_timedout_eps();
}
}
^ permalink raw reply related [flat|nested] 3+ messages in thread
* RE: [PATCH] RDMA/cxgb4: Add a sanity check in process_work()
2017-12-05 14:36 [PATCH] RDMA/cxgb4: Add a sanity check in process_work() Dan Carpenter
@ 2017-12-05 15:05 ` Steve Wise
2017-12-13 18:20 ` Jason Gunthorpe
1 sibling, 0 replies; 3+ messages in thread
From: Steve Wise @ 2017-12-05 15:05 UTC (permalink / raw)
To: 'Dan Carpenter'
Cc: 'Doug Ledford', 'Jason Gunthorpe',
linux-rdma-u79uwXL29TY76Z2rM5mHXA,
kernel-janitors-u79uwXL29TY76Z2rM5mHXA
>
> The story is that Smatch marks skb->data as untrusted so it generates
> a warning message here:
>
> drivers/infiniband/hw/cxgb4/cm.c:4100 process_work()
> error: buffer overflow 'work_handlers' 241 <= 255
>
> In other places which handle this such as t4_uld_rx_handler() there is
> some checking to make sure that the function pointer is not NULL. I
> have added bounds checking and a check for NULL here as well.
>
> Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Acked-by: Steve Wise <swise@opengridcomputing.com>
^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: RDMA/cxgb4: Add a sanity check in process_work()
2017-12-05 14:36 [PATCH] RDMA/cxgb4: Add a sanity check in process_work() Dan Carpenter
2017-12-05 15:05 ` Steve Wise
@ 2017-12-13 18:20 ` Jason Gunthorpe
1 sibling, 0 replies; 3+ messages in thread
From: Jason Gunthorpe @ 2017-12-13 18:20 UTC (permalink / raw)
To: Dan Carpenter
Cc: Steve Wise, Doug Ledford, linux-rdma-u79uwXL29TY76Z2rM5mHXA,
kernel-janitors-u79uwXL29TY76Z2rM5mHXA
On Tue, Dec 05, 2017 at 05:36:54PM +0300, Dan Carpenter wrote:
> The story is that Smatch marks skb->data as untrusted so it generates
> a warning message here:
>
> drivers/infiniband/hw/cxgb4/cm.c:4100 process_work()
> error: buffer overflow 'work_handlers' 241 <= 255
>
> In other places which handle this such as t4_uld_rx_handler() there is
> some checking to make sure that the function pointer is not NULL. I
> have added bounds checking and a check for NULL here as well.
>
> Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
> Acked-by: Steve Wise <swise@opengridcomputing.com>
Thanks, applied to -next
Jason
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2017-12-13 18:20 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2017-12-05 14:36 [PATCH] RDMA/cxgb4: Add a sanity check in process_work() Dan Carpenter
2017-12-05 15:05 ` Steve Wise
2017-12-13 18:20 ` Jason Gunthorpe
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).