From mboxrd@z Thu Jan 1 00:00:00 1970 From: Dan Carpenter Subject: [patch] IB/ipath: add a range check before bumping the stats Date: Tue, 12 Mar 2013 14:03:07 +0300 Message-ID: <20130312110307.GA22921@longonot.mountain> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Return-path: Content-Disposition: inline Sender: linux-rdma-owner-u79uwXL29TY76Z2rM5mHXA@public.gmane.org To: Mike Marciniszyn Cc: Roland Dreier , Sean Hefty , Hal Rosenstock , linux-rdma-u79uwXL29TY76Z2rM5mHXA@public.gmane.org, kernel-janitors-u79uwXL29TY76Z2rM5mHXA@public.gmane.org List-Id: linux-rdma@vger.kernel.org My static checker complains that this could corrupt memory. It seems valid to add a range check here. Signed-off-by: Dan Carpenter --- I can't test this. diff --git a/drivers/infiniband/hw/ipath/ipath_verbs.c b/drivers/infiniband/hw/ipath/ipath_verbs.c index 439c35d..f15dd70 100644 --- a/drivers/infiniband/hw/ipath/ipath_verbs.c +++ b/drivers/infiniband/hw/ipath/ipath_verbs.c @@ -621,6 +621,10 @@ void ipath_ib_rcv(struct ipath_ibdev *dev, void *rhdr, void *data, } opcode = be32_to_cpu(ohdr->bth[0]) >> 24; + if (opcode >= ARRAY_SIZE(dev->opstats)) { + dev->rcv_errors++; + goto bail; + } dev->opstats[opcode].n_bytes += tlen; dev->opstats[opcode].n_packets++; -- To unsubscribe from this list: send the line "unsubscribe linux-rdma" in the body of a message to majordomo-u79uwXL29TY76Z2rM5mHXA@public.gmane.org More majordomo info at http://vger.kernel.org/majordomo-info.html