mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2024-10-01 22:54:01 +00:00
ixgbe: Fix out-bounds warning in ixgbe_host_interface_command()
Replace union with a couple of pointers in order to fix the following out-of-bounds warning: CC [M] drivers/net/ethernet/intel/ixgbe/ixgbe_common.o drivers/net/ethernet/intel/ixgbe/ixgbe_common.c: In function ‘ixgbe_host_interface_command’: drivers/net/ethernet/intel/ixgbe/ixgbe_common.c:3729:13: warning: array subscript 1 is above array bounds of ‘u32[1]’ {aka ‘unsigned int[1]’} [-Warray-bounds] 3729 | bp->u32arr[bi] = IXGBE_READ_REG_ARRAY(hw, IXGBE_FLEX_MNG, bi); | ~~~~~~~~~~^~~~ drivers/net/ethernet/intel/ixgbe/ixgbe_common.c:3682:7: note: while referencing ‘u32arr’ 3682 | u32 u32arr[1]; | ^~~~~~ This helps with the ongoing efforts to globally enable -Warray-bounds. Link: https://github.com/KSPP/linux/issues/109 Co-developed-by: Kees Cook <keescook@chromium.org> Signed-off-by: Kees Cook <keescook@chromium.org> Signed-off-by: Gustavo A. R. Silva <gustavoars@kernel.org> Tested-by: Dave Switzer <david.switzer@intel.com> Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com> Link: https://lore.kernel.org/r/20210527173424.362456-1-anthony.l.nguyen@intel.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
This commit is contained in:
parent
cf5e129749
commit
eefa5311c3
1 changed files with 7 additions and 9 deletions
|
@ -3678,10 +3678,8 @@ s32 ixgbe_host_interface_command(struct ixgbe_hw *hw, void *buffer,
|
|||
bool return_data)
|
||||
{
|
||||
u32 hdr_size = sizeof(struct ixgbe_hic_hdr);
|
||||
union {
|
||||
struct ixgbe_hic_hdr hdr;
|
||||
u32 u32arr[1];
|
||||
} *bp = buffer;
|
||||
struct ixgbe_hic_hdr *hdr = buffer;
|
||||
u32 *u32arr = buffer;
|
||||
u16 buf_len, dword_len;
|
||||
s32 status;
|
||||
u32 bi;
|
||||
|
@ -3707,12 +3705,12 @@ s32 ixgbe_host_interface_command(struct ixgbe_hw *hw, void *buffer,
|
|||
|
||||
/* first pull in the header so we know the buffer length */
|
||||
for (bi = 0; bi < dword_len; bi++) {
|
||||
bp->u32arr[bi] = IXGBE_READ_REG_ARRAY(hw, IXGBE_FLEX_MNG, bi);
|
||||
le32_to_cpus(&bp->u32arr[bi]);
|
||||
u32arr[bi] = IXGBE_READ_REG_ARRAY(hw, IXGBE_FLEX_MNG, bi);
|
||||
le32_to_cpus(&u32arr[bi]);
|
||||
}
|
||||
|
||||
/* If there is any thing in data position pull it in */
|
||||
buf_len = bp->hdr.buf_len;
|
||||
buf_len = hdr->buf_len;
|
||||
if (!buf_len)
|
||||
goto rel_out;
|
||||
|
||||
|
@ -3727,8 +3725,8 @@ s32 ixgbe_host_interface_command(struct ixgbe_hw *hw, void *buffer,
|
|||
|
||||
/* Pull in the rest of the buffer (bi is where we left off) */
|
||||
for (; bi <= dword_len; bi++) {
|
||||
bp->u32arr[bi] = IXGBE_READ_REG_ARRAY(hw, IXGBE_FLEX_MNG, bi);
|
||||
le32_to_cpus(&bp->u32arr[bi]);
|
||||
u32arr[bi] = IXGBE_READ_REG_ARRAY(hw, IXGBE_FLEX_MNG, bi);
|
||||
le32_to_cpus(&u32arr[bi]);
|
||||
}
|
||||
|
||||
rel_out:
|
||||
|
|
Loading…
Reference in a new issue