diff options
| author | Dennis Dalessandro <dennis.dalessandro@intel.com> | 2017-05-30 03:18:14 +0300 |
|---|---|---|
| committer | Doug Ledford <dledford@redhat.com> | 2017-06-27 23:58:12 +0300 |
| commit | bc54f6714c3a5d1f7ac6e7e5a5f7c390b1a01285 (patch) | |
| tree | cb88bbf55c32434a129d2f582856dcec63a85852 | |
| parent | b2f8a04e77bad520d52b7f321ca776b33c947ad0 (diff) | |
| download | linux-bc54f6714c3a5d1f7ac6e7e5a5f7c390b1a01285.tar.xz | |
IB/hfi1: Ensure dd->gi_mask can not be overflowed
As the code stands today the array access in remap_intr() is OK. To
future proof the code though we should explicitly check to ensure the
index value is not outside of the valid range. This is not a straight
forward calculation so err on the side of caution.
Reviewed-by: Michael J. Ruhl <michael.j.ruhl@intel.com>
Signed-off-by: Dennis Dalessandro <dennis.dalessandro@intel.com>
Signed-off-by: Doug Ledford <dledford@redhat.com>
| -rw-r--r-- | drivers/infiniband/hw/hfi1/chip.c | 7 |
1 files changed, 6 insertions, 1 deletions
diff --git a/drivers/infiniband/hw/hfi1/chip.c b/drivers/infiniband/hw/hfi1/chip.c index 9118618d28e5..d6af715c35bf 100644 --- a/drivers/infiniband/hw/hfi1/chip.c +++ b/drivers/infiniband/hw/hfi1/chip.c @@ -12832,7 +12832,12 @@ static void remap_intr(struct hfi1_devdata *dd, int isrc, int msix_intr) /* clear from the handled mask of the general interrupt */ m = isrc / 64; n = isrc % 64; - dd->gi_mask[m] &= ~((u64)1 << n); + if (likely(m < CCE_NUM_INT_CSRS)) { + dd->gi_mask[m] &= ~((u64)1 << n); + } else { + dd_dev_err(dd, "remap interrupt err\n"); + return; + } /* direct the chip source to the given MSI-X interrupt */ m = isrc / 8; |