Skip to content

Commit 0435a4d

Browse files
zhangyuekuba-moo
authored andcommitted
net: qed: fix the array may be out of bound
If the variable 'p_bit->flags' is always 0, the loop condition is always 0. The variable 'j' may be greater than or equal to 32. At this time, the array 'p_aeu->bits[32]' may be out of bound. Signed-off-by: zhangyue <[email protected]> Link: https://lore.kernel.org/r/[email protected] Signed-off-by: Jakub Kicinski <[email protected]>
1 parent bacb6c1 commit 0435a4d

File tree

1 file changed

+3
-3
lines changed

1 file changed

+3
-3
lines changed

drivers/net/ethernet/qlogic/qed/qed_int.c

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1045,7 +1045,7 @@ static int qed_int_deassertion(struct qed_hwfn *p_hwfn,
10451045
if (!parities)
10461046
continue;
10471047

1048-
for (j = 0, bit_idx = 0; bit_idx < 32; j++) {
1048+
for (j = 0, bit_idx = 0; bit_idx < 32 && j < 32; j++) {
10491049
struct aeu_invert_reg_bit *p_bit = &p_aeu->bits[j];
10501050

10511051
if (qed_int_is_parity_flag(p_hwfn, p_bit) &&
@@ -1083,7 +1083,7 @@ static int qed_int_deassertion(struct qed_hwfn *p_hwfn,
10831083
* to current group, making them responsible for the
10841084
* previous assertion.
10851085
*/
1086-
for (j = 0, bit_idx = 0; bit_idx < 32; j++) {
1086+
for (j = 0, bit_idx = 0; bit_idx < 32 && j < 32; j++) {
10871087
long unsigned int bitmask;
10881088
u8 bit, bit_len;
10891089

@@ -1382,7 +1382,7 @@ static void qed_int_sb_attn_init(struct qed_hwfn *p_hwfn,
13821382
memset(sb_info->parity_mask, 0, sizeof(u32) * NUM_ATTN_REGS);
13831383
for (i = 0; i < NUM_ATTN_REGS; i++) {
13841384
/* j is array index, k is bit index */
1385-
for (j = 0, k = 0; k < 32; j++) {
1385+
for (j = 0, k = 0; k < 32 && j < 32; j++) {
13861386
struct aeu_invert_reg_bit *p_aeu;
13871387

13881388
p_aeu = &aeu_descs[i].bits[j];

0 commit comments

Comments
 (0)