Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Unverified Commit ad3e2751 authored by Dan Carpenter's avatar Dan Carpenter Committed by Jon Mason
Browse files

ntb: off by one sanity checks 



These tests are off by one.  If "mw" is equal to NTB_NUM_MW then we
would go beyond the end of the ndev->mw[] array.

Signed-off-by: default avatarDan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: default avatarJon Mason <jon.mason@intel.com>
parent 186f27ff

drivers/ntb/ntb_hw.c

+3 −3
Original line number Original line Diff line number Diff line
@@ -345,7 +345,7 @@ int ntb_read_remote_spad(struct ntb_device *ndev, unsigned int idx, u32 *val) 
 */

 */

void __iomem *ntb_get_mw_vbase(struct ntb_device *ndev, unsigned int mw)

void __iomem *ntb_get_mw_vbase(struct ntb_device *ndev, unsigned int mw)

{

{

	if (mw > NTB_NUM_MW)

	if (mw >= NTB_NUM_MW)

		return NULL;

		return NULL;





	return ndev->mw[mw].vbase;

	return ndev->mw[mw].vbase;
@@ -362,7 +362,7 @@ void __iomem *ntb_get_mw_vbase(struct ntb_device *ndev, unsigned int mw) 
 */

 */

resource_size_t ntb_get_mw_size(struct ntb_device *ndev, unsigned int mw)

resource_size_t ntb_get_mw_size(struct ntb_device *ndev, unsigned int mw)

{

{

	if (mw > NTB_NUM_MW)

	if (mw >= NTB_NUM_MW)

		return 0;

		return 0;





	return ndev->mw[mw].bar_sz;

	return ndev->mw[mw].bar_sz;
@@ -380,7 +380,7 @@ resource_size_t ntb_get_mw_size(struct ntb_device *ndev, unsigned int mw) 
 */

 */

void ntb_set_mw_addr(struct ntb_device *ndev, unsigned int mw, u64 addr)

void ntb_set_mw_addr(struct ntb_device *ndev, unsigned int mw, u64 addr)

{

{

	if (mw > NTB_NUM_MW)

	if (mw >= NTB_NUM_MW)

		return;

		return;





	dev_dbg(&ndev->pdev->dev, "Writing addr %Lx to BAR %d\n", addr,

	dev_dbg(&ndev->pdev->dev, "Writing addr %Lx to BAR %d\n", addr,