lkml.org 
[lkml]   [2021]   [Jul]   [26]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 4.14 41/82] igb: Check if num of q_vectors is smaller than max before array access
    Date
    From: Aleksandr Loktionov <aleksandr.loktionov@intel.com>

    [ Upstream commit 6c19d772618fea40d9681f259368f284a330fd90 ]

    Ensure that the adapter->q_vector[MAX_Q_VECTORS] array isn't accessed
    beyond its size. It was fixed by using a local variable num_q_vectors
    as a limit for loop index, and ensure that num_q_vectors is not bigger
    than MAX_Q_VECTORS.

    Fixes: 047e0030f1e6 ("igb: add new data structure for handling interrupts and NAPI")
    Signed-off-by: Aleksandr Loktionov <aleksandr.loktionov@intel.com>
    Reviewed-by: Grzegorz Siwik <grzegorz.siwik@intel.com>
    Reviewed-by: Arkadiusz Kubalewski <arkadiusz.kubalewski@intel.com>
    Reviewed-by: Slawomir Laba <slawomirx.laba@intel.com>
    Reviewed-by: Sylwester Dziedziuch <sylwesterx.dziedziuch@intel.com>
    Reviewed-by: Mateusz Palczewski <mateusz.placzewski@intel.com>
    Tested-by: Tony Brelinski <tonyx.brelinski@intel.com>
    Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
    Signed-off-by: Sasha Levin <sashal@kernel.org>
    ---
    drivers/net/ethernet/intel/igb/igb_main.c | 9 ++++++++-
    1 file changed, 8 insertions(+), 1 deletion(-)

    diff --git a/drivers/net/ethernet/intel/igb/igb_main.c b/drivers/net/ethernet/intel/igb/igb_main.c
    index c4898bb9896f..6bd30d51dafc 100644
    --- a/drivers/net/ethernet/intel/igb/igb_main.c
    +++ b/drivers/net/ethernet/intel/igb/igb_main.c
    @@ -949,6 +949,7 @@ static void igb_configure_msix(struct igb_adapter *adapter)
    **/
    static int igb_request_msix(struct igb_adapter *adapter)
    {
    + unsigned int num_q_vectors = adapter->num_q_vectors;
    struct net_device *netdev = adapter->netdev;
    int i, err = 0, vector = 0, free_vector = 0;

    @@ -957,7 +958,13 @@ static int igb_request_msix(struct igb_adapter *adapter)
    if (err)
    goto err_out;

    - for (i = 0; i < adapter->num_q_vectors; i++) {
    + if (num_q_vectors > MAX_Q_VECTORS) {
    + num_q_vectors = MAX_Q_VECTORS;
    + dev_warn(&adapter->pdev->dev,
    + "The number of queue vectors (%d) is higher than max allowed (%d)\n",
    + adapter->num_q_vectors, MAX_Q_VECTORS);
    + }
    + for (i = 0; i < num_q_vectors; i++) {
    struct igb_q_vector *q_vector = adapter->q_vector[i];

    vector++;
    --
    2.30.2


    \
     
     \ /
      Last update: 2021-07-26 17:52    [W:4.166 / U:0.112 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site