Skip to content

Commit

Permalink
cxgb4: fix signed wrap around when decrementing index idx
Browse files Browse the repository at this point in the history
Change predecrement compare to post decrement compare to avoid an
unsigned integer wrap-around comparison when decrementing idx in
the while loop.

For example, when idx is zero, the current situation will
predecrement idx in the while loop, wrapping idx to the maximum
signed integer and cause out of bounds reads on rxq_info->msix_tbl[idx].

Signed-off-by: Colin Ian King <colin.king@canonical.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
  • Loading branch information
Colin Ian King authored and David S. Miller committed Sep 23, 2016
1 parent c7b9e63 commit e12934d
Showing 1 changed file with 1 addition and 1 deletion.
2 changes: 1 addition & 1 deletion drivers/net/ethernet/chelsio/cxgb4/cxgb4_uld.c
Original file line number Diff line number Diff line change
Expand Up @@ -367,7 +367,7 @@ int request_msix_queue_irqs_uld(struct adapter *adap, unsigned int uld_type)
}
return 0;
unwind:
while (--idx >= 0) {
while (idx-- > 0) {
bmap_idx = rxq_info->msix_tbl[idx];
free_msix_idx_in_bmap(adap, bmap_idx);
free_irq(adap->msix_info_ulds[bmap_idx].vec,
Expand Down

0 comments on commit e12934d

Please sign in to comment.