* [PATCH] RDMA/nldev: prevent underflow in nldev_stat_set_counter_dynamic_doit()
@ 2022-03-16 8:39 Dan Carpenter
2022-03-16 9:08 ` Leon Romanovsky
2022-03-18 18:46 ` Jason Gunthorpe
0 siblings, 2 replies; 3+ messages in thread
From: Dan Carpenter @ 2022-03-16 8:39 UTC (permalink / raw)
To: Jason Gunthorpe, Aharon Landau
Cc: Leon Romanovsky, Mark Zhang, Neta Ostrovsky, Gal Pressman,
linux-rdma, kernel-janitors
This code checks "index" for an upper bound but it does not check for
negatives. Change the type to unsigned to prevent underflows.
Fixes: 3c3c1f141639 ("RDMA/nldev: Allow optional-counter status configuration through RDMA netlink")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
---
Could we not use a nldev_policy[] to tighten the bounds checking even
more?
drivers/infiniband/core/nldev.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/drivers/infiniband/core/nldev.c b/drivers/infiniband/core/nldev.c
index f5aacaf7fb8e..ca24ce34da76 100644
--- a/drivers/infiniband/core/nldev.c
+++ b/drivers/infiniband/core/nldev.c
@@ -1951,9 +1951,10 @@ static int nldev_stat_set_counter_dynamic_doit(struct nlattr *tb[],
u32 port)
{
struct rdma_hw_stats *stats;
- int rem, i, index, ret = 0;
struct nlattr *entry_attr;
unsigned long *target;
+ int rem, i, ret = 0;
+ u32 index;
stats = ib_get_hw_stats_port(device, port);
if (!stats)
--
2.20.1
^ permalink raw reply related [flat|nested] 3+ messages in thread* Re: [PATCH] RDMA/nldev: prevent underflow in nldev_stat_set_counter_dynamic_doit()
2022-03-16 8:39 [PATCH] RDMA/nldev: prevent underflow in nldev_stat_set_counter_dynamic_doit() Dan Carpenter
@ 2022-03-16 9:08 ` Leon Romanovsky
2022-03-18 18:46 ` Jason Gunthorpe
1 sibling, 0 replies; 3+ messages in thread
From: Leon Romanovsky @ 2022-03-16 9:08 UTC (permalink / raw)
To: Dan Carpenter
Cc: Jason Gunthorpe, Aharon Landau, Mark Zhang, Neta Ostrovsky,
Gal Pressman, linux-rdma, kernel-janitors
On Wed, Mar 16, 2022 at 11:39:48AM +0300, Dan Carpenter wrote:
> This code checks "index" for an upper bound but it does not check for
> negatives. Change the type to unsigned to prevent underflows.
>
> Fixes: 3c3c1f141639 ("RDMA/nldev: Allow optional-counter status configuration through RDMA netlink")
> Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
> ---
> Could we not use a nldev_policy[] to tighten the bounds checking even
> more?
We are doing it, when calling to nlmsg_parse() at the beginning of nldev_stat_set_doit().
The entry_attr, which used as input to index, is tb[RDMA_NLDEV_ATTR_STAT_HWCOUNTER_INDEX].
However it is not enough and we still need your change, because input
can be large enough to be casted to negative value.
Thanks,
Reviewed-by: Leon Romanovsky <leonro@nvidia.com>
^ permalink raw reply [flat|nested] 3+ messages in thread* Re: [PATCH] RDMA/nldev: prevent underflow in nldev_stat_set_counter_dynamic_doit()
2022-03-16 8:39 [PATCH] RDMA/nldev: prevent underflow in nldev_stat_set_counter_dynamic_doit() Dan Carpenter
2022-03-16 9:08 ` Leon Romanovsky
@ 2022-03-18 18:46 ` Jason Gunthorpe
1 sibling, 0 replies; 3+ messages in thread
From: Jason Gunthorpe @ 2022-03-18 18:46 UTC (permalink / raw)
To: Dan Carpenter
Cc: Aharon Landau, Leon Romanovsky, Mark Zhang, Neta Ostrovsky,
Gal Pressman, linux-rdma, kernel-janitors
On Wed, Mar 16, 2022 at 11:39:48AM +0300, Dan Carpenter wrote:
> This code checks "index" for an upper bound but it does not check for
> negatives. Change the type to unsigned to prevent underflows.
>
> Fixes: 3c3c1f141639 ("RDMA/nldev: Allow optional-counter status configuration through RDMA netlink")
> Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
> Reviewed-by: Leon Romanovsky <leonro@nvidia.com>
> ---
> Could we not use a nldev_policy[] to tighten the bounds checking even
> more?
>
> drivers/infiniband/core/nldev.c | 3 ++-
> 1 file changed, 2 insertions(+), 1 deletion(-)
Applied to for-next, thanks
Jason
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2022-03-18 18:46 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2022-03-16 8:39 [PATCH] RDMA/nldev: prevent underflow in nldev_stat_set_counter_dynamic_doit() Dan Carpenter
2022-03-16 9:08 ` Leon Romanovsky
2022-03-18 18:46 ` Jason Gunthorpe
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox