* [PATCH] net/mlx4_core: Avoid impossible mlx4_db_alloc() order value
@ 2025-02-10 17:45 Kees Cook
2025-02-11 0:01 ` Justin Stitt
2025-02-15 3:50 ` patchwork-bot+netdevbpf
0 siblings, 2 replies; 6+ messages in thread
From: Kees Cook @ 2025-02-10 17:45 UTC (permalink / raw)
To: Tariq Toukan
Cc: Kees Cook, Andrew Lunn, David S. Miller, Eric Dumazet,
Jakub Kicinski, Paolo Abeni, Yishai Hadas, netdev, linux-rdma,
linux-kernel, linux-hardening
GCC can see that the value range for "order" is capped, but this leads
it to consider that it might be negative, leading to a false positive
warning (with GCC 15 with -Warray-bounds -fdiagnostics-details):
../drivers/net/ethernet/mellanox/mlx4/alloc.c:691:47: error: array subscript -1 is below array bounds of 'long unsigned int *[2]' [-Werror=array-bounds=]
691 | i = find_first_bit(pgdir->bits[o], MLX4_DB_PER_PAGE >> o);
| ~~~~~~~~~~~^~~
'mlx4_alloc_db_from_pgdir': events 1-2
691 | i = find_first_bit(pgdir->bits[o], MLX4_DB_PER_PAGE >> o); | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
| | | | | (2) out of array bounds here
| (1) when the condition is evaluated to true In file included from ../drivers/net/ethernet/mellanox/mlx4/mlx4.h:53,
from ../drivers/net/ethernet/mellanox/mlx4/alloc.c:42:
../include/linux/mlx4/device.h:664:33: note: while referencing 'bits'
664 | unsigned long *bits[2];
| ^~~~
Switch the argument to unsigned int, which removes the compiler needing
to consider negative values.
Signed-off-by: Kees Cook <kees@kernel.org>
---
Cc: Tariq Toukan <tariqt@nvidia.com>
Cc: Andrew Lunn <andrew+netdev@lunn.ch>
Cc: "David S. Miller" <davem@davemloft.net>
Cc: Eric Dumazet <edumazet@google.com>
Cc: Jakub Kicinski <kuba@kernel.org>
Cc: Paolo Abeni <pabeni@redhat.com>
Cc: Yishai Hadas <yishaih@nvidia.com>
Cc: netdev@vger.kernel.org
Cc: linux-rdma@vger.kernel.org
---
drivers/net/ethernet/mellanox/mlx4/alloc.c | 6 +++---
include/linux/mlx4/device.h | 2 +-
2 files changed, 4 insertions(+), 4 deletions(-)
diff --git a/drivers/net/ethernet/mellanox/mlx4/alloc.c b/drivers/net/ethernet/mellanox/mlx4/alloc.c
index b330020dc0d6..f2bded847e61 100644
--- a/drivers/net/ethernet/mellanox/mlx4/alloc.c
+++ b/drivers/net/ethernet/mellanox/mlx4/alloc.c
@@ -682,9 +682,9 @@ static struct mlx4_db_pgdir *mlx4_alloc_db_pgdir(struct device *dma_device)
}
static int mlx4_alloc_db_from_pgdir(struct mlx4_db_pgdir *pgdir,
- struct mlx4_db *db, int order)
+ struct mlx4_db *db, unsigned int order)
{
- int o;
+ unsigned int o;
int i;
for (o = order; o <= 1; ++o) {
@@ -712,7 +712,7 @@ static int mlx4_alloc_db_from_pgdir(struct mlx4_db_pgdir *pgdir,
return 0;
}
-int mlx4_db_alloc(struct mlx4_dev *dev, struct mlx4_db *db, int order)
+int mlx4_db_alloc(struct mlx4_dev *dev, struct mlx4_db *db, unsigned int order)
{
struct mlx4_priv *priv = mlx4_priv(dev);
struct mlx4_db_pgdir *pgdir;
diff --git a/include/linux/mlx4/device.h b/include/linux/mlx4/device.h
index 27f42f713c89..86f0f2a25a3d 100644
--- a/include/linux/mlx4/device.h
+++ b/include/linux/mlx4/device.h
@@ -1135,7 +1135,7 @@ int mlx4_write_mtt(struct mlx4_dev *dev, struct mlx4_mtt *mtt,
int mlx4_buf_write_mtt(struct mlx4_dev *dev, struct mlx4_mtt *mtt,
struct mlx4_buf *buf);
-int mlx4_db_alloc(struct mlx4_dev *dev, struct mlx4_db *db, int order);
+int mlx4_db_alloc(struct mlx4_dev *dev, struct mlx4_db *db, unsigned int order);
void mlx4_db_free(struct mlx4_dev *dev, struct mlx4_db *db);
int mlx4_alloc_hwq_res(struct mlx4_dev *dev, struct mlx4_hwq_resources *wqres,
--
2.34.1
^ permalink raw reply related [flat|nested] 6+ messages in thread* Re: [PATCH] net/mlx4_core: Avoid impossible mlx4_db_alloc() order value
2025-02-10 17:45 [PATCH] net/mlx4_core: Avoid impossible mlx4_db_alloc() order value Kees Cook
@ 2025-02-11 0:01 ` Justin Stitt
2025-02-11 14:22 ` Tariq Toukan
2025-02-15 3:50 ` patchwork-bot+netdevbpf
1 sibling, 1 reply; 6+ messages in thread
From: Justin Stitt @ 2025-02-11 0:01 UTC (permalink / raw)
To: Kees Cook
Cc: Tariq Toukan, Andrew Lunn, David S. Miller, Eric Dumazet,
Jakub Kicinski, Paolo Abeni, Yishai Hadas, netdev, linux-rdma,
linux-kernel, linux-hardening
On Mon, Feb 10, 2025 at 09:45:05AM -0800, Kees Cook wrote:
> GCC can see that the value range for "order" is capped, but this leads
> it to consider that it might be negative, leading to a false positive
> warning (with GCC 15 with -Warray-bounds -fdiagnostics-details):
>
> ../drivers/net/ethernet/mellanox/mlx4/alloc.c:691:47: error: array subscript -1 is below array bounds of 'long unsigned int *[2]' [-Werror=array-bounds=]
> 691 | i = find_first_bit(pgdir->bits[o], MLX4_DB_PER_PAGE >> o);
> | ~~~~~~~~~~~^~~
> 'mlx4_alloc_db_from_pgdir': events 1-2
> 691 | i = find_first_bit(pgdir->bits[o], MLX4_DB_PER_PAGE >> o); | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
> | | | | | (2) out of array bounds here
> | (1) when the condition is evaluated to true In file included from ../drivers/net/ethernet/mellanox/mlx4/mlx4.h:53,
> from ../drivers/net/ethernet/mellanox/mlx4/alloc.c:42:
> ../include/linux/mlx4/device.h:664:33: note: while referencing 'bits'
> 664 | unsigned long *bits[2];
> | ^~~~
>
> Switch the argument to unsigned int, which removes the compiler needing
> to consider negative values.
>
> Signed-off-by: Kees Cook <kees@kernel.org>
> ---
> Cc: Tariq Toukan <tariqt@nvidia.com>
> Cc: Andrew Lunn <andrew+netdev@lunn.ch>
> Cc: "David S. Miller" <davem@davemloft.net>
> Cc: Eric Dumazet <edumazet@google.com>
> Cc: Jakub Kicinski <kuba@kernel.org>
> Cc: Paolo Abeni <pabeni@redhat.com>
> Cc: Yishai Hadas <yishaih@nvidia.com>
> Cc: netdev@vger.kernel.org
> Cc: linux-rdma@vger.kernel.org
> ---
> drivers/net/ethernet/mellanox/mlx4/alloc.c | 6 +++---
> include/linux/mlx4/device.h | 2 +-
> 2 files changed, 4 insertions(+), 4 deletions(-)
>
> diff --git a/drivers/net/ethernet/mellanox/mlx4/alloc.c b/drivers/net/ethernet/mellanox/mlx4/alloc.c
> index b330020dc0d6..f2bded847e61 100644
> --- a/drivers/net/ethernet/mellanox/mlx4/alloc.c
> +++ b/drivers/net/ethernet/mellanox/mlx4/alloc.c
> @@ -682,9 +682,9 @@ static struct mlx4_db_pgdir *mlx4_alloc_db_pgdir(struct device *dma_device)
> }
>
> static int mlx4_alloc_db_from_pgdir(struct mlx4_db_pgdir *pgdir,
> - struct mlx4_db *db, int order)
> + struct mlx4_db *db, unsigned int order)
> {
> - int o;
> + unsigned int o;
> int i;
>
> for (o = order; o <= 1; ++o) {
^ Knowing now that @order can only be 0 or 1 can this for loop (and
goto) be dropped entirely?
The code is already short and sweet so I don't feel strongly either
way.
> @@ -712,7 +712,7 @@ static int mlx4_alloc_db_from_pgdir(struct mlx4_db_pgdir *pgdir,
> return 0;
> }
>
> -int mlx4_db_alloc(struct mlx4_dev *dev, struct mlx4_db *db, int order)
> +int mlx4_db_alloc(struct mlx4_dev *dev, struct mlx4_db *db, unsigned int order)
> {
> struct mlx4_priv *priv = mlx4_priv(dev);
> struct mlx4_db_pgdir *pgdir;
> diff --git a/include/linux/mlx4/device.h b/include/linux/mlx4/device.h
> index 27f42f713c89..86f0f2a25a3d 100644
> --- a/include/linux/mlx4/device.h
> +++ b/include/linux/mlx4/device.h
> @@ -1135,7 +1135,7 @@ int mlx4_write_mtt(struct mlx4_dev *dev, struct mlx4_mtt *mtt,
> int mlx4_buf_write_mtt(struct mlx4_dev *dev, struct mlx4_mtt *mtt,
> struct mlx4_buf *buf);
>
> -int mlx4_db_alloc(struct mlx4_dev *dev, struct mlx4_db *db, int order);
> +int mlx4_db_alloc(struct mlx4_dev *dev, struct mlx4_db *db, unsigned int order);
> void mlx4_db_free(struct mlx4_dev *dev, struct mlx4_db *db);
>
> int mlx4_alloc_hwq_res(struct mlx4_dev *dev, struct mlx4_hwq_resources *wqres,
> --
> 2.34.1
>
Justin
^ permalink raw reply [flat|nested] 6+ messages in thread* Re: [PATCH] net/mlx4_core: Avoid impossible mlx4_db_alloc() order value
2025-02-11 0:01 ` Justin Stitt
@ 2025-02-11 14:22 ` Tariq Toukan
2025-02-13 0:10 ` Justin Stitt
0 siblings, 1 reply; 6+ messages in thread
From: Tariq Toukan @ 2025-02-11 14:22 UTC (permalink / raw)
To: Justin Stitt, Kees Cook
Cc: Tariq Toukan, Andrew Lunn, David S. Miller, Eric Dumazet,
Jakub Kicinski, Paolo Abeni, Yishai Hadas, netdev, linux-rdma,
linux-kernel, linux-hardening
On 11/02/2025 2:01, Justin Stitt wrote:
> On Mon, Feb 10, 2025 at 09:45:05AM -0800, Kees Cook wrote:
>> GCC can see that the value range for "order" is capped, but this leads
>> it to consider that it might be negative, leading to a false positive
>> warning (with GCC 15 with -Warray-bounds -fdiagnostics-details):
>>
>> ../drivers/net/ethernet/mellanox/mlx4/alloc.c:691:47: error: array subscript -1 is below array bounds of 'long unsigned int *[2]' [-Werror=array-bounds=]
>> 691 | i = find_first_bit(pgdir->bits[o], MLX4_DB_PER_PAGE >> o);
>> | ~~~~~~~~~~~^~~
>> 'mlx4_alloc_db_from_pgdir': events 1-2
>> 691 | i = find_first_bit(pgdir->bits[o], MLX4_DB_PER_PAGE >> o); | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
>> | | | | | (2) out of array bounds here
>> | (1) when the condition is evaluated to true In file included from ../drivers/net/ethernet/mellanox/mlx4/mlx4.h:53,
>> from ../drivers/net/ethernet/mellanox/mlx4/alloc.c:42:
>> ../include/linux/mlx4/device.h:664:33: note: while referencing 'bits'
>> 664 | unsigned long *bits[2];
>> | ^~~~
>>
>> Switch the argument to unsigned int, which removes the compiler needing
>> to consider negative values.
>>
>> Signed-off-by: Kees Cook <kees@kernel.org>
>> ---
>> Cc: Tariq Toukan <tariqt@nvidia.com>
>> Cc: Andrew Lunn <andrew+netdev@lunn.ch>
>> Cc: "David S. Miller" <davem@davemloft.net>
>> Cc: Eric Dumazet <edumazet@google.com>
>> Cc: Jakub Kicinski <kuba@kernel.org>
>> Cc: Paolo Abeni <pabeni@redhat.com>
>> Cc: Yishai Hadas <yishaih@nvidia.com>
>> Cc: netdev@vger.kernel.org
>> Cc: linux-rdma@vger.kernel.org
>> ---
>> drivers/net/ethernet/mellanox/mlx4/alloc.c | 6 +++---
>> include/linux/mlx4/device.h | 2 +-
>> 2 files changed, 4 insertions(+), 4 deletions(-)
>>
>> diff --git a/drivers/net/ethernet/mellanox/mlx4/alloc.c b/drivers/net/ethernet/mellanox/mlx4/alloc.c
>> index b330020dc0d6..f2bded847e61 100644
>> --- a/drivers/net/ethernet/mellanox/mlx4/alloc.c
>> +++ b/drivers/net/ethernet/mellanox/mlx4/alloc.c
>> @@ -682,9 +682,9 @@ static struct mlx4_db_pgdir *mlx4_alloc_db_pgdir(struct device *dma_device)
>> }
>>
>> static int mlx4_alloc_db_from_pgdir(struct mlx4_db_pgdir *pgdir,
>> - struct mlx4_db *db, int order)
>> + struct mlx4_db *db, unsigned int order)
>> {
>> - int o;
>> + unsigned int o;
>> int i;
>>
>> for (o = order; o <= 1; ++o) {
>
> ^ Knowing now that @order can only be 0 or 1 can this for loop (and
> goto) be dropped entirely?
>
Maybe I'm missing something...
Can you please explain why you think this can be dropped?
> The code is already short and sweet so I don't feel strongly either
> way.
>
>> @@ -712,7 +712,7 @@ static int mlx4_alloc_db_from_pgdir(struct mlx4_db_pgdir *pgdir,
>> return 0;
>> }
>>
>> -int mlx4_db_alloc(struct mlx4_dev *dev, struct mlx4_db *db, int order)
>> +int mlx4_db_alloc(struct mlx4_dev *dev, struct mlx4_db *db, unsigned int order)
>> {
>> struct mlx4_priv *priv = mlx4_priv(dev);
>> struct mlx4_db_pgdir *pgdir;
>> diff --git a/include/linux/mlx4/device.h b/include/linux/mlx4/device.h
>> index 27f42f713c89..86f0f2a25a3d 100644
>> --- a/include/linux/mlx4/device.h
>> +++ b/include/linux/mlx4/device.h
>> @@ -1135,7 +1135,7 @@ int mlx4_write_mtt(struct mlx4_dev *dev, struct mlx4_mtt *mtt,
>> int mlx4_buf_write_mtt(struct mlx4_dev *dev, struct mlx4_mtt *mtt,
>> struct mlx4_buf *buf);
>>
>> -int mlx4_db_alloc(struct mlx4_dev *dev, struct mlx4_db *db, int order);
>> +int mlx4_db_alloc(struct mlx4_dev *dev, struct mlx4_db *db, unsigned int order);
>> void mlx4_db_free(struct mlx4_dev *dev, struct mlx4_db *db);
>>
>> int mlx4_alloc_hwq_res(struct mlx4_dev *dev, struct mlx4_hwq_resources *wqres,
>> --
>> 2.34.1
>>
>
> Justin
>
^ permalink raw reply [flat|nested] 6+ messages in thread* Re: [PATCH] net/mlx4_core: Avoid impossible mlx4_db_alloc() order value
2025-02-11 14:22 ` Tariq Toukan
@ 2025-02-13 0:10 ` Justin Stitt
2025-02-13 10:13 ` Paolo Abeni
0 siblings, 1 reply; 6+ messages in thread
From: Justin Stitt @ 2025-02-13 0:10 UTC (permalink / raw)
To: Tariq Toukan
Cc: Kees Cook, Tariq Toukan, Andrew Lunn, David S. Miller,
Eric Dumazet, Jakub Kicinski, Paolo Abeni, Yishai Hadas, netdev,
linux-rdma, linux-kernel, linux-hardening
On Tue, Feb 11, 2025 at 6:22 AM Tariq Toukan <ttoukan.linux@gmail.com> wrote:
>
>
>
> On 11/02/2025 2:01, Justin Stitt wrote:
> > On Mon, Feb 10, 2025 at 09:45:05AM -0800, Kees Cook wrote:
> >> GCC can see that the value range for "order" is capped, but this leads
> >> it to consider that it might be negative, leading to a false positive
> >> warning (with GCC 15 with -Warray-bounds -fdiagnostics-details):
> >>
> >> ../drivers/net/ethernet/mellanox/mlx4/alloc.c:691:47: error: array subscript -1 is below array bounds of 'long unsigned int *[2]' [-Werror=array-bounds=]
> >> 691 | i = find_first_bit(pgdir->bits[o], MLX4_DB_PER_PAGE >> o);
> >> | ~~~~~~~~~~~^~~
> >> 'mlx4_alloc_db_from_pgdir': events 1-2
> >> 691 | i = find_first_bit(pgdir->bits[o], MLX4_DB_PER_PAGE >> o); | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
> >> | | | | | (2) out of array bounds here
> >> | (1) when the condition is evaluated to true In file included from ../drivers/net/ethernet/mellanox/mlx4/mlx4.h:53,
> >> from ../drivers/net/ethernet/mellanox/mlx4/alloc.c:42:
> >> ../include/linux/mlx4/device.h:664:33: note: while referencing 'bits'
> >> 664 | unsigned long *bits[2];
> >> | ^~~~
> >>
> >> Switch the argument to unsigned int, which removes the compiler needing
> >> to consider negative values.
> >>
> >> Signed-off-by: Kees Cook <kees@kernel.org>
> >> ---
> >> Cc: Tariq Toukan <tariqt@nvidia.com>
> >> Cc: Andrew Lunn <andrew+netdev@lunn.ch>
> >> Cc: "David S. Miller" <davem@davemloft.net>
> >> Cc: Eric Dumazet <edumazet@google.com>
> >> Cc: Jakub Kicinski <kuba@kernel.org>
> >> Cc: Paolo Abeni <pabeni@redhat.com>
> >> Cc: Yishai Hadas <yishaih@nvidia.com>
> >> Cc: netdev@vger.kernel.org
> >> Cc: linux-rdma@vger.kernel.org
> >> ---
> >> drivers/net/ethernet/mellanox/mlx4/alloc.c | 6 +++---
> >> include/linux/mlx4/device.h | 2 +-
> >> 2 files changed, 4 insertions(+), 4 deletions(-)
> >>
> >> diff --git a/drivers/net/ethernet/mellanox/mlx4/alloc.c b/drivers/net/ethernet/mellanox/mlx4/alloc.c
> >> index b330020dc0d6..f2bded847e61 100644
> >> --- a/drivers/net/ethernet/mellanox/mlx4/alloc.c
> >> +++ b/drivers/net/ethernet/mellanox/mlx4/alloc.c
> >> @@ -682,9 +682,9 @@ static struct mlx4_db_pgdir *mlx4_alloc_db_pgdir(struct device *dma_device)
> >> }
> >>
> >> static int mlx4_alloc_db_from_pgdir(struct mlx4_db_pgdir *pgdir,
> >> - struct mlx4_db *db, int order)
> >> + struct mlx4_db *db, unsigned int order)
> >> {
> >> - int o;
> >> + unsigned int o;
> >> int i;
> >>
> >> for (o = order; o <= 1; ++o) {
> >
> > ^ Knowing now that @order can only be 0 or 1 can this for loop (and
> > goto) be dropped entirely?
> >
>
> Maybe I'm missing something...
> Can you please explain why you think this can be dropped?
I meant "rewritten to use two if statements" instead of "dropped". I
think "replaced" or "refactored" was the word I wanted.
>
>
> > The code is already short and sweet so I don't feel strongly either
> > way.
> >
> >> @@ -712,7 +712,7 @@ static int mlx4_alloc_db_from_pgdir(struct mlx4_db_pgdir *pgdir,
> >> return 0;
> >> }
> >>
> >> -int mlx4_db_alloc(struct mlx4_dev *dev, struct mlx4_db *db, int order)
> >> +int mlx4_db_alloc(struct mlx4_dev *dev, struct mlx4_db *db, unsigned int order)
> >> {
> >> struct mlx4_priv *priv = mlx4_priv(dev);
> >> struct mlx4_db_pgdir *pgdir;
> >> diff --git a/include/linux/mlx4/device.h b/include/linux/mlx4/device.h
> >> index 27f42f713c89..86f0f2a25a3d 100644
> >> --- a/include/linux/mlx4/device.h
> >> +++ b/include/linux/mlx4/device.h
> >> @@ -1135,7 +1135,7 @@ int mlx4_write_mtt(struct mlx4_dev *dev, struct mlx4_mtt *mtt,
> >> int mlx4_buf_write_mtt(struct mlx4_dev *dev, struct mlx4_mtt *mtt,
> >> struct mlx4_buf *buf);
> >>
> >> -int mlx4_db_alloc(struct mlx4_dev *dev, struct mlx4_db *db, int order);
> >> +int mlx4_db_alloc(struct mlx4_dev *dev, struct mlx4_db *db, unsigned int order);
> >> void mlx4_db_free(struct mlx4_dev *dev, struct mlx4_db *db);
> >>
> >> int mlx4_alloc_hwq_res(struct mlx4_dev *dev, struct mlx4_hwq_resources *wqres,
> >> --
> >> 2.34.1
> >>
> >
> > Justin
> >
>
^ permalink raw reply [flat|nested] 6+ messages in thread* Re: [PATCH] net/mlx4_core: Avoid impossible mlx4_db_alloc() order value
2025-02-13 0:10 ` Justin Stitt
@ 2025-02-13 10:13 ` Paolo Abeni
0 siblings, 0 replies; 6+ messages in thread
From: Paolo Abeni @ 2025-02-13 10:13 UTC (permalink / raw)
To: Justin Stitt, Tariq Toukan
Cc: Kees Cook, Tariq Toukan, Andrew Lunn, David S. Miller,
Eric Dumazet, Jakub Kicinski, Yishai Hadas, netdev, linux-rdma,
linux-kernel, linux-hardening
On 2/13/25 1:10 AM, Justin Stitt wrote:
> On Tue, Feb 11, 2025 at 6:22 AM Tariq Toukan <ttoukan.linux@gmail.com> wrote:
>> On 11/02/2025 2:01, Justin Stitt wrote:
>>>> diff --git a/drivers/net/ethernet/mellanox/mlx4/alloc.c b/drivers/net/ethernet/mellanox/mlx4/alloc.c
>>>> index b330020dc0d6..f2bded847e61 100644
>>>> --- a/drivers/net/ethernet/mellanox/mlx4/alloc.c
>>>> +++ b/drivers/net/ethernet/mellanox/mlx4/alloc.c
>>>> @@ -682,9 +682,9 @@ static struct mlx4_db_pgdir *mlx4_alloc_db_pgdir(struct device *dma_device)
>>>> }
>>>>
>>>> static int mlx4_alloc_db_from_pgdir(struct mlx4_db_pgdir *pgdir,
>>>> - struct mlx4_db *db, int order)
>>>> + struct mlx4_db *db, unsigned int order)
>>>> {
>>>> - int o;
>>>> + unsigned int o;
>>>> int i;
>>>>
>>>> for (o = order; o <= 1; ++o) {
>>>
>>> ^ Knowing now that @order can only be 0 or 1 can this for loop (and
>>> goto) be dropped entirely?
>>>
>>
>> Maybe I'm missing something...
>> Can you please explain why you think this can be dropped?
>
> I meant "rewritten to use two if statements" instead of "dropped". I
> think "replaced" or "refactored" was the word I wanted.
IMHO that would be a significant uglification, not worthy to address an
issue that could be solved with the patch proposed here.
@Tariq: are you ok with this patch?
Thanks,
Paolo
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [PATCH] net/mlx4_core: Avoid impossible mlx4_db_alloc() order value
2025-02-10 17:45 [PATCH] net/mlx4_core: Avoid impossible mlx4_db_alloc() order value Kees Cook
2025-02-11 0:01 ` Justin Stitt
@ 2025-02-15 3:50 ` patchwork-bot+netdevbpf
1 sibling, 0 replies; 6+ messages in thread
From: patchwork-bot+netdevbpf @ 2025-02-15 3:50 UTC (permalink / raw)
To: Kees Cook
Cc: tariqt, andrew+netdev, davem, edumazet, kuba, pabeni, yishaih,
netdev, linux-rdma, linux-kernel, linux-hardening
Hello:
This patch was applied to netdev/net-next.git (main)
by Jakub Kicinski <kuba@kernel.org>:
On Mon, 10 Feb 2025 09:45:05 -0800 you wrote:
> GCC can see that the value range for "order" is capped, but this leads
> it to consider that it might be negative, leading to a false positive
> warning (with GCC 15 with -Warray-bounds -fdiagnostics-details):
>
> ../drivers/net/ethernet/mellanox/mlx4/alloc.c:691:47: error: array subscript -1 is below array bounds of 'long unsigned int *[2]' [-Werror=array-bounds=]
> 691 | i = find_first_bit(pgdir->bits[o], MLX4_DB_PER_PAGE >> o);
> | ~~~~~~~~~~~^~~
> 'mlx4_alloc_db_from_pgdir': events 1-2
> 691 | i = find_first_bit(pgdir->bits[o], MLX4_DB_PER_PAGE >> o); | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
> | | | | | (2) out of array bounds here
> | (1) when the condition is evaluated to true In file included from ../drivers/net/ethernet/mellanox/mlx4/mlx4.h:53,
> from ../drivers/net/ethernet/mellanox/mlx4/alloc.c:42:
> ../include/linux/mlx4/device.h:664:33: note: while referencing 'bits'
> 664 | unsigned long *bits[2];
> | ^~~~
>
> [...]
Here is the summary with links:
- net/mlx4_core: Avoid impossible mlx4_db_alloc() order value
https://git.kernel.org/netdev/net-next/c/4a6f18f28627
You are awesome, thank you!
--
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html
^ permalink raw reply [flat|nested] 6+ messages in thread
end of thread, other threads:[~2025-02-15 3:50 UTC | newest]
Thread overview: 6+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2025-02-10 17:45 [PATCH] net/mlx4_core: Avoid impossible mlx4_db_alloc() order value Kees Cook
2025-02-11 0:01 ` Justin Stitt
2025-02-11 14:22 ` Tariq Toukan
2025-02-13 0:10 ` Justin Stitt
2025-02-13 10:13 ` Paolo Abeni
2025-02-15 3:50 ` patchwork-bot+netdevbpf
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).