[patch net-next] sfc: a couple off by one bugs

[patch net-next] sfc: a couple off by one bugs

[Dan Carpenter]

These checks are off by one.  These are just sanity checks and we don't
ever pass invalid values for "encap_type" so it's harmless.

Fixes: 9b4108012517 ("sfc: insert catch-all filters for encapsulated traffic")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>

diff --git a/drivers/net/ethernet/sfc/ef10.c b/drivers/net/ethernet/sfc/ef10.c
index 8bec9383d754..dec0c8083ff3 100644
--- a/drivers/net/ethernet/sfc/ef10.c
+++ b/drivers/net/ethernet/sfc/ef10.c
@@ -5080,7 +5080,7 @@ static int efx_ef10_filter_insert_def(struct efx_nic *efx,
 
 		/* quick bounds check (BCAST result impossible) */
 		BUILD_BUG_ON(EFX_EF10_BCAST != 0);
-		if (encap_type > ARRAY_SIZE(map) || map[encap_type] == 0) {
+		if (encap_type >= ARRAY_SIZE(map) || map[encap_type] == 0) {
 			WARN_ON(1);
 			return -EINVAL;
 		}
@@ -5134,7 +5134,7 @@ static int efx_ef10_filter_insert_def(struct efx_nic *efx,
 
 		/* quick bounds check (BCAST result impossible) */
 		BUILD_BUG_ON(EFX_EF10_BCAST != 0);
-		if (encap_type > ARRAY_SIZE(map) || map[encap_type] == 0) {
+		if (encap_type >= ARRAY_SIZE(map) || map[encap_type] == 0) {
 			WARN_ON(1);
 			return -EINVAL;
 		}

Re: [patch net-next] sfc: a couple off by one bugs

[Edward Cree]

On 01/02/17 08:50, Dan Carpenter wrote:
> These checks are off by one.  These are just sanity checks and we don't
> ever pass invalid values for "encap_type" so it's harmless.
>
> Fixes: 9b4108012517 ("sfc: insert catch-all filters for encapsulated traffic")
> Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
One of these was already fixed by Colin Ian King in
e9904990e8e70a51574e6ec6b872f3c705ec75f0 ("sfc: fix an off-by-one compare on an
array size").
For the other one:
Acked-by: Edward Cree <ecree@solarflare.com>
> diff --git a/drivers/net/ethernet/sfc/ef10.c b/drivers/net/ethernet/sfc/ef10.c
> index 8bec9383d754..dec0c8083ff3 100644
> --- a/drivers/net/ethernet/sfc/ef10.c
> +++ b/drivers/net/ethernet/sfc/ef10.c
> @@ -5080,7 +5080,7 @@ static int efx_ef10_filter_insert_def(struct efx_nic *efx,
>  
>  		/* quick bounds check (BCAST result impossible) */
>  		BUILD_BUG_ON(EFX_EF10_BCAST != 0);
> -		if (encap_type > ARRAY_SIZE(map) || map[encap_type] == 0) {
> +		if (encap_type >= ARRAY_SIZE(map) || map[encap_type] == 0) {
>  			WARN_ON(1);
>  			return -EINVAL;
>  		}
> @@ -5134,7 +5134,7 @@ static int efx_ef10_filter_insert_def(struct efx_nic *efx,
>  
>  		/* quick bounds check (BCAST result impossible) */
>  		BUILD_BUG_ON(EFX_EF10_BCAST != 0);
> -		if (encap_type > ARRAY_SIZE(map) || map[encap_type] == 0) {
> +		if (encap_type >= ARRAY_SIZE(map) || map[encap_type] == 0) {
>  			WARN_ON(1);
>  			return -EINVAL;
>  		}

Re: [patch net-next] sfc: a couple off by one bugs

[Colin Ian King]

On 01/02/17 13:24, Edward Cree wrote:
> On 01/02/17 08:50, Dan Carpenter wrote:
>> These checks are off by one.  These are just sanity checks and we don't
>> ever pass invalid values for "encap_type" so it's harmless.
>>
>> Fixes: 9b4108012517 ("sfc: insert catch-all filters for encapsulated traffic")
>> Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
> One of these was already fixed by Colin Ian King in
> e9904990e8e70a51574e6ec6b872f3c705ec75f0 ("sfc: fix an off-by-one compare on an
> array size").

Ugh, I missed one of those.

> For the other one:
> Acked-by: Edward Cree <ecree@solarflare.com>
>> diff --git a/drivers/net/ethernet/sfc/ef10.c b/drivers/net/ethernet/sfc/ef10.c
>> index 8bec9383d754..dec0c8083ff3 100644
>> --- a/drivers/net/ethernet/sfc/ef10.c
>> +++ b/drivers/net/ethernet/sfc/ef10.c
>> @@ -5080,7 +5080,7 @@ static int efx_ef10_filter_insert_def(struct efx_nic *efx,
>>
>>               /* quick bounds check (BCAST result impossible) */
>>               BUILD_BUG_ON(EFX_EF10_BCAST != 0);
>> -             if (encap_type > ARRAY_SIZE(map) || map[encap_type] == 0) {
>> +             if (encap_type >= ARRAY_SIZE(map) || map[encap_type] == 0) {
>>                       WARN_ON(1);
>>                       return -EINVAL;
>>               }
>> @@ -5134,7 +5134,7 @@ static int efx_ef10_filter_insert_def(struct efx_nic *efx,
>>
>>               /* quick bounds check (BCAST result impossible) */
>>               BUILD_BUG_ON(EFX_EF10_BCAST != 0);
>> -             if (encap_type > ARRAY_SIZE(map) || map[encap_type] == 0) {
>> +             if (encap_type >= ARRAY_SIZE(map) || map[encap_type] == 0) {
>>                       WARN_ON(1);
>>                       return -EINVAL;
>>               }
> 
> 
> The information contained in this message is confidential and is intended for the addressee(s) only. If you have received this message in error, please notify the sender immediately and delete the message. Unless you are an addressee (or authorized to receive for an addressee), you may not use, copy or disclose to anyone this message or any information contained in this message. The unauthorized use, disclosure, copying or alteration of this message is strictly prohibited.
> --
> To unsubscribe from this list: send the line "unsubscribe kernel-janitors" in
> the body of a message to majordomo@vger.kernel.org
> More majordomo info at  http://vger.kernel.org/majordomo-info.html
> 

Re: [patch net-next] sfc: a couple off by one bugs

[David Miller]

From: Dan Carpenter <dan.carpenter@oracle.com>
Date: Wed, 1 Feb 2017 11:50:40 +0300

> These checks are off by one.  These are just sanity checks and we don't
> ever pass invalid values for "encap_type" so it's harmless.
> 
> Fixes: 9b4108012517 ("sfc: insert catch-all filters for encapsulated traffic")
> Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>

Please respin against net-next and Colin's fix.

Thanks.

[patch v2 net-next] sfc: fix an off by one bug

[Dan Carpenter]

This bug is harmless because it's just a sanity check and we always
pass valid values for "encap_type" but the test is off by one.

Fixes: 9b4108012517 ("sfc: insert catch-all filters for encapsulated traffic")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
---
v2: Rebased against last linux-next

diff --git a/drivers/net/ethernet/sfc/ef10.c b/drivers/net/ethernet/sfc/ef10.c
index 0475f1831b92..dec0c8083ff3 100644
--- a/drivers/net/ethernet/sfc/ef10.c
+++ b/drivers/net/ethernet/sfc/ef10.c
@@ -5134,7 +5134,7 @@ static int efx_ef10_filter_insert_def(struct efx_nic *efx,
 
 		/* quick bounds check (BCAST result impossible) */
 		BUILD_BUG_ON(EFX_EF10_BCAST != 0);
-		if (encap_type > ARRAY_SIZE(map) || map[encap_type] == 0) {
+		if (encap_type >= ARRAY_SIZE(map) || map[encap_type] == 0) {
 			WARN_ON(1);
 			return -EINVAL;
 		}

Re: [patch v2 net-next] sfc: fix an off by one bug

[Bert Kenward]

On 07/02/17 07:44, Dan Carpenter wrote:
> This bug is harmless because it's just a sanity check and we always
> pass valid values for "encap_type" but the test is off by one.
> 
> Fixes: 9b4108012517 ("sfc: insert catch-all filters for encapsulated traffic")
> Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>

Thanks Dan.

Acked-by: Bert Kenward <bkenward@solarflare.com>

Re: [patch v2 net-next] sfc: fix an off by one bug

[David Miller]

From: Dan Carpenter <dan.carpenter@oracle.com>
Date: Tue, 7 Feb 2017 10:44:31 +0300

> This bug is harmless because it's just a sanity check and we always
> pass valid values for "encap_type" but the test is off by one.
> 
> Fixes: 9b4108012517 ("sfc: insert catch-all filters for encapsulated traffic")
> Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
> ---
> v2: Rebased against last linux-next

Applied, thanks Dan.