[PATCH 3.9-stable] ntb: off by one sanity checks

[PATCH 3.9-stable] ntb: off by one sanity checks

[Jonghwan Choi]

From: Dan Carpenter <dan.carpenter@oracle.com>

This patch looks like it should be in the 3.9-stable tree, should we apply
it?

------------------

From: "Dan Carpenter <dan.carpenter@oracle.com>"

commit ad3e2751e7c546ae678be1f8d86e898506b42cef upstream

These tests are off by one.  If "mw" is equal to NTB_NUM_MW then we
would go beyond the end of the ndev->mw[] array.

Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Jon Mason <jon.mason@intel.com>
Signed-off-by: Jonghwan Choi <jhbird.choi@samsung.com>
---
 drivers/ntb/ntb_hw.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/drivers/ntb/ntb_hw.c b/drivers/ntb/ntb_hw.c
index f802e7c..195cc51 100644
--- a/drivers/ntb/ntb_hw.c
+++ b/drivers/ntb/ntb_hw.c
@@ -345,7 +345,7 @@ int ntb_read_remote_spad(struct ntb_device *ndev, unsigned int idx, u32 *val)
  */
 void __iomem *ntb_get_mw_vbase(struct ntb_device *ndev, unsigned int mw)
 {
-	if (mw > NTB_NUM_MW)
+	if (mw >= NTB_NUM_MW)
 		return NULL;
 
 	return ndev->mw[mw].vbase;
@@ -362,7 +362,7 @@ void __iomem *ntb_get_mw_vbase(struct ntb_device *ndev, unsigned int mw)
  */
 resource_size_t ntb_get_mw_size(struct ntb_device *ndev, unsigned int mw)
 {
-	if (mw > NTB_NUM_MW)
+	if (mw >= NTB_NUM_MW)
 		return 0;
 
 	return ndev->mw[mw].bar_sz;
@@ -380,7 +380,7 @@ resource_size_t ntb_get_mw_size(struct ntb_device *ndev, unsigned int mw)
  */
 void ntb_set_mw_addr(struct ntb_device *ndev, unsigned int mw, u64 addr)
 {
-	if (mw > NTB_NUM_MW)
+	if (mw >= NTB_NUM_MW)
 		return;
 
 	dev_dbg(&ndev->pdev->dev, "Writing addr %Lx to BAR %d\n", addr,
-- 
1.8.1.2

Re: [PATCH 3.9-stable] ntb: off by one sanity checks

[Jon Mason]

On Sat, May 18, 2013 at 11:35:38AM +0900, Jonghwan Choi wrote:
> From: Dan Carpenter <dan.carpenter@oracle.com>
> 
> This patch looks like it should be in the 3.9-stable tree, should we apply
> it?

Yes, please do.  I'll respond to each of the patch series, but please
apply them all.  Also, one patch was omitted from these, titled 
NTB: variable dereferenced before check

Please include that patch in 3.9 stable as well.

Thank you for doing this.

Thanks,
Jon

> 
> ------------------
> 
> From: "Dan Carpenter <dan.carpenter@oracle.com>"
> 
> commit ad3e2751e7c546ae678be1f8d86e898506b42cef upstream
> 
> These tests are off by one.  If "mw" is equal to NTB_NUM_MW then we
> would go beyond the end of the ndev->mw[] array.
> 
> Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
> Signed-off-by: Jon Mason <jon.mason@intel.com>
> Signed-off-by: Jonghwan Choi <jhbird.choi@samsung.com>
> ---
>  drivers/ntb/ntb_hw.c | 6 +++---
>  1 file changed, 3 insertions(+), 3 deletions(-)
> 
> diff --git a/drivers/ntb/ntb_hw.c b/drivers/ntb/ntb_hw.c
> index f802e7c..195cc51 100644
> --- a/drivers/ntb/ntb_hw.c
> +++ b/drivers/ntb/ntb_hw.c
> @@ -345,7 +345,7 @@ int ntb_read_remote_spad(struct ntb_device *ndev, unsigned int idx, u32 *val)
>   */
>  void __iomem *ntb_get_mw_vbase(struct ntb_device *ndev, unsigned int mw)
>  {
> -	if (mw > NTB_NUM_MW)
> +	if (mw >= NTB_NUM_MW)
>  		return NULL;
>  
>  	return ndev->mw[mw].vbase;
> @@ -362,7 +362,7 @@ void __iomem *ntb_get_mw_vbase(struct ntb_device *ndev, unsigned int mw)
>   */
>  resource_size_t ntb_get_mw_size(struct ntb_device *ndev, unsigned int mw)
>  {
> -	if (mw > NTB_NUM_MW)
> +	if (mw >= NTB_NUM_MW)
>  		return 0;
>  
>  	return ndev->mw[mw].bar_sz;
> @@ -380,7 +380,7 @@ resource_size_t ntb_get_mw_size(struct ntb_device *ndev, unsigned int mw)
>   */
>  void ntb_set_mw_addr(struct ntb_device *ndev, unsigned int mw, u64 addr)
>  {
> -	if (mw > NTB_NUM_MW)
> +	if (mw >= NTB_NUM_MW)
>  		return;
>  
>  	dev_dbg(&ndev->pdev->dev, "Writing addr %Lx to BAR %d\n", addr,
> -- 
> 1.8.1.2
> 

Re: [PATCH 3.9-stable] ntb: off by one sanity checks

[Greg KH]

On Sat, May 18, 2013 at 07:47:09AM -0700, Jon Mason wrote:
> On Sat, May 18, 2013 at 11:35:38AM +0900, Jonghwan Choi wrote:
> > From: Dan Carpenter <dan.carpenter@oracle.com>
> > 
> > This patch looks like it should be in the 3.9-stable tree, should we apply
> > it?
> 
> Yes, please do.  I'll respond to each of the patch series, but please
> apply them all.  Also, one patch was omitted from these, titled 
> NTB: variable dereferenced before check
> 
> Please include that patch in 3.9 stable as well.

Can you just send me the git commit ids of the patches you wish to see
applied to the stable tree, and the order in which they need to go in?

Also, in the future, please tag the patches you want in the stable
releases with the proper "Cc: Stable <stable@vger.kernel.org>" line in
the signed-off-by: area of the patch, so I can pick it up automagically.

thanks,

greg k-h

Re: [PATCH 3.9-stable] ntb: off by one sanity checks

[Jon Mason]

On Mon, May 20, 2013 at 09:38:50AM -0700, Greg KH wrote:
> On Sat, May 18, 2013 at 07:47:09AM -0700, Jon Mason wrote:
> > On Sat, May 18, 2013 at 11:35:38AM +0900, Jonghwan Choi wrote:
> > > From: Dan Carpenter <dan.carpenter@oracle.com>
> > > 
> > > This patch looks like it should be in the 3.9-stable tree, should we apply
> > > it?
> > 
> > Yes, please do.  I'll respond to each of the patch series, but please
> > apply them all.  Also, one patch was omitted from these, titled 
> > NTB: variable dereferenced before check
> > 
> > Please include that patch in 3.9 stable as well.
> 
> Can you just send me the git commit ids of the patches you wish to see
> applied to the stable tree, and the order in which they need to go in?

My apologies.  All the commits to Linus' tree were bug fixes, so all
of them should be pulled.  You can get them at:

git://github.com/jonmason/ntb.git tags/ntb-bugfixes-3.10

or, if you just want the commit ids (in order of oldest to newest)

186f27ff9f9ec5c110739ced88ce9f8fca053882
ad3e2751e7c546ae678be1f8d86e898506b42cef
cc0f868d8adef7bdc12cda132654870086d766bc
113fc505b83b2d16e820ca74fa07f99a34877b1d
b77b2637b39ecc380bb08992380d7d48452b0872
90f9e934647e652a69396e18c779215a493271cf
c9d534c8cbaedbb522a1d2cb037c6c394f610317
c336acd3331dcc191a97dbc66a557d47741657c7
904435cf76a9bdd5eb41b1c4e049d5a64f3a8400
8b19d450ad188d402a183ff4a4d40f31c3916fbf

> Also, in the future, please tag the patches you want in the stable
> releases with the proper "Cc: Stable <stable@vger.kernel.org>" line in
> the signed-off-by: area of the patch, so I can pick it up automagically.

Will do.

Thanks,
Jon

> thanks,
> 
> greg k-h

Re: [PATCH 3.9-stable] ntb: off by one sanity checks

[Greg KH]

On Mon, May 20, 2013 at 09:51:29AM -0700, Jon Mason wrote:
> On Mon, May 20, 2013 at 09:38:50AM -0700, Greg KH wrote:
> > On Sat, May 18, 2013 at 07:47:09AM -0700, Jon Mason wrote:
> > > On Sat, May 18, 2013 at 11:35:38AM +0900, Jonghwan Choi wrote:
> > > > From: Dan Carpenter <dan.carpenter@oracle.com>
> > > > 
> > > > This patch looks like it should be in the 3.9-stable tree, should we apply
> > > > it?
> > > 
> > > Yes, please do.  I'll respond to each of the patch series, but please
> > > apply them all.  Also, one patch was omitted from these, titled 
> > > NTB: variable dereferenced before check
> > > 
> > > Please include that patch in 3.9 stable as well.
> > 
> > Can you just send me the git commit ids of the patches you wish to see
> > applied to the stable tree, and the order in which they need to go in?
> 
> My apologies.  All the commits to Linus' tree were bug fixes, so all
> of them should be pulled.  You can get them at:
> 
> git://github.com/jonmason/ntb.git tags/ntb-bugfixes-3.10
> 
> or, if you just want the commit ids (in order of oldest to newest)
> 
> 186f27ff9f9ec5c110739ced88ce9f8fca053882
> ad3e2751e7c546ae678be1f8d86e898506b42cef
> cc0f868d8adef7bdc12cda132654870086d766bc

These are bugfixes.

> 113fc505b83b2d16e820ca74fa07f99a34877b1d

This is a new feature, not a -stable candidate.


> b77b2637b39ecc380bb08992380d7d48452b0872

Ugh, but this one, needs the previous one :(

> 90f9e934647e652a69396e18c779215a493271cf
> c9d534c8cbaedbb522a1d2cb037c6c394f610317
> c336acd3331dcc191a97dbc66a557d47741657c7
> 904435cf76a9bdd5eb41b1c4e049d5a64f3a8400
> 8b19d450ad188d402a183ff4a4d40f31c3916fbf

All bugfixes.  Ok, I've now applied them all, thanks.

greg k-h