Messages in this thread Patch in this message | | | Date | Sun, 12 Dec 2010 22:40:15 +0100 (CET) | From | Jesper Juhl <> | Subject | [PATCH] Don't index beyond end of intr_remap_fault_reasons array in dmar_get_fault_reason |
| |
Hi,
In drivers/pci/dmar.c::dmar_get_fault_reason() we have 7 entries in the intr_remap_fault_reasons array and then this code:
... if (fault_reason >= 0x20 && (fault_reason <= 0x20 + ARRAY_SIZE(intr_remap_fault_reasons))) { *fault_type = INTR_REMAP; return intr_remap_fault_reasons[fault_reason - 0x20]; ...
This ends up allowing array index values of 0-7 (both inclusive). A value of 7 indexes 1 past the end of the array, so I believe the code should be this instead:
... if (fault_reason >= 0x20 && (fault_reason <= 0x20 + ARRAY_SIZE(intr_remap_fault_reasons) - 1)) { *fault_type = INTR_REMAP; return intr_remap_fault_reasons[fault_reason - 0x20]; ...
Which only allows the actually legal values 0-6.
The patch below makes that change and also (while I was there) removes the completely unused #define MAX_FAULT_REASON_IDX .
Signed-off-by: Jesper Juhl <jj@chaosbits.net> --- dmar.c | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-)
diff --git a/drivers/pci/dmar.c b/drivers/pci/dmar.c index 0157708..f210f96 100644 --- a/drivers/pci/dmar.c +++ b/drivers/pci/dmar.c @@ -1207,12 +1207,10 @@ static const char *intr_remap_fault_reasons[] = "Blocked an interrupt request due to source-id verification failure", }; -#define MAX_FAULT_REASON_IDX (ARRAY_SIZE(fault_reason_strings) - 1) - const char *dmar_get_fault_reason(u8 fault_reason, int *fault_type) { if (fault_reason >= 0x20 && (fault_reason <= 0x20 + - ARRAY_SIZE(intr_remap_fault_reasons))) { + ARRAY_SIZE(intr_remap_fault_reasons) - 1)) { *fault_type = INTR_REMAP; return intr_remap_fault_reasons[fault_reason - 0x20]; } else if (fault_reason < ARRAY_SIZE(dma_remap_fault_reasons)) {
-- Jesper Juhl <jj@chaosbits.net> http://www.chaosbits.net/ Don't top-post http://www.catb.org/~esr/jargon/html/T/top-post.html Plain text mails only, please.
| |