From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S965778AbbKDVtO (ORCPT ); Wed, 4 Nov 2015 16:49:14 -0500 Received: from mx01-fr.bfs.de ([193.174.231.67]:32968 "EHLO mx01-fr.bfs.de" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S965410AbbKDVtL (ORCPT ); Wed, 4 Nov 2015 16:49:11 -0500 X-Greylist: delayed 539 seconds by postgrey-1.27 at vger.kernel.org; Wed, 04 Nov 2015 16:49:10 EST Message-ID: <563A7B2D.4040904@bfs.de> Date: Wed, 04 Nov 2015 22:39:57 +0100 From: walter harms Reply-To: wharms@bfs.de User-Agent: Mozilla/5.0 (X11; U; Linux x86_64; de; rv:1.9.1.16) Gecko/20101125 SUSE/3.0.11 Thunderbird/3.0.11 MIME-Version: 1.0 To: Dan Carpenter CC: Alex Williamson , Frank Blaschka , kvm@vger.kernel.org, linux-kernel@vger.kernel.org, kernel-janitors@vger.kernel.org Subject: Re: [patch] vfio: make an array larger References: <20151104132624.GC20966@mwanda> In-Reply-To: <20151104132624.GC20966@mwanda> Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: 7bit Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Am 04.11.2015 14:26, schrieb Dan Carpenter: > Smatch complains about a possible out of bounds error: > > drivers/vfio/pci/vfio_pci_config.c:1241 vfio_cap_init() > error: buffer overflow 'pci_cap_length' 20 <= 20 > > Fix this by making the array larger. > > Signed-off-by: Dan Carpenter > > diff --git a/drivers/vfio/pci/vfio_pci_config.c b/drivers/vfio/pci/vfio_pci_config.c > index ff75ca3..001d48a 100644 > --- a/drivers/vfio/pci/vfio_pci_config.c > +++ b/drivers/vfio/pci/vfio_pci_config.c > @@ -46,7 +46,7 @@ > * 0: Removed from the user visible capability list > * FF: Variable length > */ > -static u8 pci_cap_length[] = { > +static u8 pci_cap_length[PCI_CAP_ID_MAX + 1] = { > [PCI_CAP_ID_BASIC] = PCI_STD_HEADER_SIZEOF, /* pci config header */ > [PCI_CAP_ID_PM] = PCI_PM_SIZEOF, > [PCI_CAP_ID_AGP] = PCI_AGP_SIZEOF, (i am sorry Dave) I am not sure if that is the way to go. this define make me feel uneasy, #define PCI_CAP_ID_MAX PCI_CAP_ID_AF Would it be possible to ARRAY_SIZE(pci_cap_length) instead of PCI_CAP_ID_MAX ? Then that would grow automatically with the array. And its more clear what is actually happening. re, wh >