* [PATCH 1/2] hte: fix off by one in hte_push_ts_ns()
@ 2022-05-06 14:53 Dan Carpenter
2022-05-06 14:54 ` [PATCH 2/2] hte: uninitialized variable in hte_ts_get() Dan Carpenter
2022-05-06 18:25 ` [PATCH 1/2] hte: fix off by one in hte_push_ts_ns() Dipen Patel
0 siblings, 2 replies; 4+ messages in thread
From: Dan Carpenter @ 2022-05-06 14:53 UTC (permalink / raw)
To: Dipen Patel; +Cc: Thierry Reding, linux-kernel, kernel-janitors
The &chip->gdev->ei[] array has chip->nlines elements so this >
comparison needs to be >= to prevent an out of bounds access. The
gdev->ei[] array is allocated in hte_register_chip().
Fixes: 31ab09b42188 ("drivers: Add hardware timestamp engine (HTE) subsystem")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
---
drivers/hte/hte.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/hte/hte.c b/drivers/hte/hte.c
index 891b98ad609e..a14c5bf290ff 100644
--- a/drivers/hte/hte.c
+++ b/drivers/hte/hte.c
@@ -811,7 +811,7 @@ int hte_push_ts_ns(const struct hte_chip *chip, u32 xlated_id,
if (!chip || !data || !chip->gdev)
return -EINVAL;
- if (xlated_id > chip->nlines)
+ if (xlated_id >= chip->nlines)
return -EINVAL;
ei = &chip->gdev->ei[xlated_id];
--
2.35.1
^ permalink raw reply related [flat|nested] 4+ messages in thread* [PATCH 2/2] hte: uninitialized variable in hte_ts_get()
2022-05-06 14:53 [PATCH 1/2] hte: fix off by one in hte_push_ts_ns() Dan Carpenter
@ 2022-05-06 14:54 ` Dan Carpenter
2022-05-06 18:21 ` Dipen Patel
2022-05-06 18:25 ` [PATCH 1/2] hte: fix off by one in hte_push_ts_ns() Dipen Patel
1 sibling, 1 reply; 4+ messages in thread
From: Dan Carpenter @ 2022-05-06 14:54 UTC (permalink / raw)
To: Dipen Patel; +Cc: linux-kernel, kernel-janitors
The "free_name" variable is sometimes used without being initialized.
31ab09b42188 ("drivers: Add hardware timestamp engine (HTE) subsystem")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
---
drivers/hte/hte.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/hte/hte.c b/drivers/hte/hte.c
index a14c5bf290ff..7c3b4476f890 100644
--- a/drivers/hte/hte.c
+++ b/drivers/hte/hte.c
@@ -572,7 +572,7 @@ int hte_ts_get(struct device *dev, struct hte_ts_desc *desc, int index)
struct of_phandle_args args;
u32 xlated_id;
int ret;
- bool free_name;
+ bool free_name = false;
if (!desc)
return -EINVAL;
--
2.35.1
^ permalink raw reply related [flat|nested] 4+ messages in thread* Re: [PATCH 2/2] hte: uninitialized variable in hte_ts_get()
2022-05-06 14:54 ` [PATCH 2/2] hte: uninitialized variable in hte_ts_get() Dan Carpenter
@ 2022-05-06 18:21 ` Dipen Patel
0 siblings, 0 replies; 4+ messages in thread
From: Dipen Patel @ 2022-05-06 18:21 UTC (permalink / raw)
To: Dan Carpenter; +Cc: linux-kernel, kernel-janitors
Acked-by: Dipen Patel
On 5/6/22 7:54 AM, Dan Carpenter wrote:
> The "free_name" variable is sometimes used without being initialized.
>
> 31ab09b42188 ("drivers: Add hardware timestamp engine (HTE) subsystem")
> Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
> ---
> drivers/hte/hte.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/drivers/hte/hte.c b/drivers/hte/hte.c
> index a14c5bf290ff..7c3b4476f890 100644
> --- a/drivers/hte/hte.c
> +++ b/drivers/hte/hte.c
> @@ -572,7 +572,7 @@ int hte_ts_get(struct device *dev, struct hte_ts_desc *desc, int index)
> struct of_phandle_args args;
> u32 xlated_id;
> int ret;
> - bool free_name;
> + bool free_name = false;
>
> if (!desc)
> return -EINVAL;
^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: [PATCH 1/2] hte: fix off by one in hte_push_ts_ns()
2022-05-06 14:53 [PATCH 1/2] hte: fix off by one in hte_push_ts_ns() Dan Carpenter
2022-05-06 14:54 ` [PATCH 2/2] hte: uninitialized variable in hte_ts_get() Dan Carpenter
@ 2022-05-06 18:25 ` Dipen Patel
1 sibling, 0 replies; 4+ messages in thread
From: Dipen Patel @ 2022-05-06 18:25 UTC (permalink / raw)
To: Dan Carpenter; +Cc: Thierry Reding, linux-kernel, kernel-janitors
good catch. Thanks.
Reviewed-by: Dipen Patel
Acked-by: Dipen Patel
On 5/6/22 7:53 AM, Dan Carpenter wrote:
> The &chip->gdev->ei[] array has chip->nlines elements so this >
> comparison needs to be >= to prevent an out of bounds access. The
> gdev->ei[] array is allocated in hte_register_chip().
>
> Fixes: 31ab09b42188 ("drivers: Add hardware timestamp engine (HTE) subsystem")
> Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
> ---
> drivers/hte/hte.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/drivers/hte/hte.c b/drivers/hte/hte.c
> index 891b98ad609e..a14c5bf290ff 100644
> --- a/drivers/hte/hte.c
> +++ b/drivers/hte/hte.c
> @@ -811,7 +811,7 @@ int hte_push_ts_ns(const struct hte_chip *chip, u32 xlated_id,
> if (!chip || !data || !chip->gdev)
> return -EINVAL;
>
> - if (xlated_id > chip->nlines)
> + if (xlated_id >= chip->nlines)
> return -EINVAL;
>
> ei = &chip->gdev->ei[xlated_id];
^ permalink raw reply [flat|nested] 4+ messages in thread
end of thread, other threads:[~2022-05-06 18:25 UTC | newest]
Thread overview: 4+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2022-05-06 14:53 [PATCH 1/2] hte: fix off by one in hte_push_ts_ns() Dan Carpenter
2022-05-06 14:54 ` [PATCH 2/2] hte: uninitialized variable in hte_ts_get() Dan Carpenter
2022-05-06 18:21 ` Dipen Patel
2022-05-06 18:25 ` [PATCH 1/2] hte: fix off by one in hte_push_ts_ns() Dipen Patel
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox