* [PATCH] netxen: Correct off-by-one errors in bounds checks
@ 2013-12-20 4:10 David Gibson
2013-12-27 18:08 ` David Miller
0 siblings, 1 reply; 2+ messages in thread
From: David Gibson @ 2013-12-20 4:10 UTC (permalink / raw)
To: manish.chopra, sony.chacko, rajesh.borundia; +Cc: netdev, David Gibson
netxen_process_lro() contains two bounds checks. One for the ring number
against the number of rings, and one for the Rx buffer ID against the
array of receive buffers.
Both of these have off-by-one errors, using > instead of >=. The correct
versions are used in netxen_process_rcv(), they're just wrong in
netxen_process_lro().
Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
---
drivers/net/ethernet/qlogic/netxen/netxen_nic_init.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/net/ethernet/qlogic/netxen/netxen_nic_init.c b/drivers/net/ethernet/qlogic/netxen/netxen_nic_init.c
index 7692dfd..cc68657 100644
--- a/drivers/net/ethernet/qlogic/netxen/netxen_nic_init.c
+++ b/drivers/net/ethernet/qlogic/netxen/netxen_nic_init.c
@@ -1604,13 +1604,13 @@ netxen_process_lro(struct netxen_adapter *adapter,
u32 seq_number;
u8 vhdr_len = 0;
- if (unlikely(ring > adapter->max_rds_rings))
+ if (unlikely(ring >= adapter->max_rds_rings))
return NULL;
rds_ring = &recv_ctx->rds_rings[ring];
index = netxen_get_lro_sts_refhandle(sts_data0);
- if (unlikely(index > rds_ring->num_desc))
+ if (unlikely(index >= rds_ring->num_desc))
return NULL;
buffer = &rds_ring->rx_buf_arr[index];
--
1.8.4.2
^ permalink raw reply related [flat|nested] 2+ messages in thread
* Re: [PATCH] netxen: Correct off-by-one errors in bounds checks
2013-12-20 4:10 [PATCH] netxen: Correct off-by-one errors in bounds checks David Gibson
@ 2013-12-27 18:08 ` David Miller
0 siblings, 0 replies; 2+ messages in thread
From: David Miller @ 2013-12-27 18:08 UTC (permalink / raw)
To: david; +Cc: manish.chopra, sony.chacko, rajesh.borundia, netdev
From: David Gibson <david@gibson.dropbear.id.au>
Date: Fri, 20 Dec 2013 15:10:44 +1100
> netxen_process_lro() contains two bounds checks. One for the ring number
> against the number of rings, and one for the Rx buffer ID against the
> array of receive buffers.
>
> Both of these have off-by-one errors, using > instead of >=. The correct
> versions are used in netxen_process_rcv(), they're just wrong in
> netxen_process_lro().
>
> Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
Looks good, applied, thanks David.
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2013-12-27 18:08 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2013-12-20 4:10 [PATCH] netxen: Correct off-by-one errors in bounds checks David Gibson
2013-12-27 18:08 ` David Miller
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).