diff options
| author | Dennis Dalessandro <dennis.dalessandro@intel.com> | 2017-05-30 02:18:14 +0200 |
|---|---|---|
| committer | Doug Ledford <dledford@redhat.com> | 2017-07-17 17:39:45 +0200 |
| commit | 91647f4c2d66e16b30524613410a638c2c4532bf (patch) | |
| tree | 9a88b6ca6d6f4a84f4c008c43274ecb3d3ec7849 | |
| parent | Merge tag 'v4.13-rc1' into k.o/for-4.13-rc (diff) | |
| download | linux-91647f4c2d66e16b30524613410a638c2c4532bf.tar.xz linux-91647f4c2d66e16b30524613410a638c2c4532bf.zip | |
IB/hfi1: Ensure dd->gi_mask can not be overflowed
As the code stands today the array access in remap_intr() is OK. To
future proof the code though we should explicitly check to ensure the
index value is not outside of the valid range. This is not a straight
forward calculation so err on the side of caution.
Reviewed-by: Michael J. Ruhl <michael.j.ruhl@intel.com>
Signed-off-by: Dennis Dalessandro <dennis.dalessandro@intel.com>
Signed-off-by: Doug Ledford <dledford@redhat.com>
| -rw-r--r-- | drivers/infiniband/hw/hfi1/chip.c | 7 |
1 files changed, 6 insertions, 1 deletions
diff --git a/drivers/infiniband/hw/hfi1/chip.c b/drivers/infiniband/hw/hfi1/chip.c index 2ba00b89df6a..94b54850ec75 100644 --- a/drivers/infiniband/hw/hfi1/chip.c +++ b/drivers/infiniband/hw/hfi1/chip.c @@ -12847,7 +12847,12 @@ static void remap_intr(struct hfi1_devdata *dd, int isrc, int msix_intr) /* clear from the handled mask of the general interrupt */ m = isrc / 64; n = isrc % 64; - dd->gi_mask[m] &= ~((u64)1 << n); + if (likely(m < CCE_NUM_INT_CSRS)) { + dd->gi_mask[m] &= ~((u64)1 << n); + } else { + dd_dev_err(dd, "remap interrupt err\n"); + return; + } /* direct the chip source to the given MSI-X interrupt */ m = isrc / 8; |