Commit 0435a4d0 authored by zhangyue's avatar zhangyue Committed by Jakub Kicinski

net: qed: fix the array may be out of bound

If the variable 'p_bit->flags' is always 0,
the loop condition is always 0.

The variable 'j' may be greater than or equal to 32.

At this time, the array 'p_aeu->bits[32]' may be out
of bound.
Signed-off-by: default avatarzhangyue <zhangyue1@kylinos.cn>
Link: https://lore.kernel.org/r/20211125113610.273841-1-zhangyue1@kylinos.cnSigned-off-by: default avatarJakub Kicinski <kuba@kernel.org>
parent bacb6c1e
...@@ -1045,7 +1045,7 @@ static int qed_int_deassertion(struct qed_hwfn *p_hwfn, ...@@ -1045,7 +1045,7 @@ static int qed_int_deassertion(struct qed_hwfn *p_hwfn,
if (!parities) if (!parities)
continue; continue;
for (j = 0, bit_idx = 0; bit_idx < 32; j++) { for (j = 0, bit_idx = 0; bit_idx < 32 && j < 32; j++) {
struct aeu_invert_reg_bit *p_bit = &p_aeu->bits[j]; struct aeu_invert_reg_bit *p_bit = &p_aeu->bits[j];
if (qed_int_is_parity_flag(p_hwfn, p_bit) && if (qed_int_is_parity_flag(p_hwfn, p_bit) &&
...@@ -1083,7 +1083,7 @@ static int qed_int_deassertion(struct qed_hwfn *p_hwfn, ...@@ -1083,7 +1083,7 @@ static int qed_int_deassertion(struct qed_hwfn *p_hwfn,
* to current group, making them responsible for the * to current group, making them responsible for the
* previous assertion. * previous assertion.
*/ */
for (j = 0, bit_idx = 0; bit_idx < 32; j++) { for (j = 0, bit_idx = 0; bit_idx < 32 && j < 32; j++) {
long unsigned int bitmask; long unsigned int bitmask;
u8 bit, bit_len; u8 bit, bit_len;
...@@ -1382,7 +1382,7 @@ static void qed_int_sb_attn_init(struct qed_hwfn *p_hwfn, ...@@ -1382,7 +1382,7 @@ static void qed_int_sb_attn_init(struct qed_hwfn *p_hwfn,
memset(sb_info->parity_mask, 0, sizeof(u32) * NUM_ATTN_REGS); memset(sb_info->parity_mask, 0, sizeof(u32) * NUM_ATTN_REGS);
for (i = 0; i < NUM_ATTN_REGS; i++) { for (i = 0; i < NUM_ATTN_REGS; i++) {
/* j is array index, k is bit index */ /* j is array index, k is bit index */
for (j = 0, k = 0; k < 32; j++) { for (j = 0, k = 0; k < 32 && j < 32; j++) {
struct aeu_invert_reg_bit *p_aeu; struct aeu_invert_reg_bit *p_aeu;
p_aeu = &aeu_descs[i].bits[j]; p_aeu = &aeu_descs[i].bits[j];
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment