From patchwork Mon Mar 14 14:18:35 2016 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Arnd Bergmann X-Patchwork-Id: 102594 Delivered-To: patch@linaro.org Received: by 10.112.199.169 with SMTP id jl9csp65558lbc; Mon, 14 Mar 2016 07:22:16 -0700 (PDT) X-Received: by 10.66.218.225 with SMTP id pj1mr37750857pac.83.1457965335848; Mon, 14 Mar 2016 07:22:15 -0700 (PDT) Return-Path: Received: from vger.kernel.org (vger.kernel.org. [209.132.180.67]) by mx.google.com with ESMTP id t27si369488pfi.203.2016.03.14.07.22.15; Mon, 14 Mar 2016 07:22:15 -0700 (PDT) Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67; Authentication-Results: mx.google.com; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S965365AbcCNOWG (ORCPT + 31 others); Mon, 14 Mar 2016 10:22:06 -0400 Received: from mout.kundenserver.de ([212.227.17.13]:57204 "EHLO mout.kundenserver.de" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S965345AbcCNOWA (ORCPT ); Mon, 14 Mar 2016 10:22:00 -0400 Received: from wuerfel.lan. ([78.42.132.4]) by mrelayeu.kundenserver.de (mreue102) with ESMTPA (Nemesis) id 0MY6a0-1aJSLj3BQG-00Uu0s; Mon, 14 Mar 2016 15:18:51 +0100 From: Arnd Bergmann To: "David S. Miller" Cc: netdev@vger.kernel.org, Arnd Bergmann , Kevin Curtis , linux-kernel@vger.kernel.org Subject: [PATCH 2/5] farsync: fix off-by-one bug in fst_add_one Date: Mon, 14 Mar 2016 15:18:35 +0100 Message-Id: <1457965120-3155420-3-git-send-email-arnd@arndb.de> X-Mailer: git-send-email 2.7.0 In-Reply-To: <1457965120-3155420-1-git-send-email-arnd@arndb.de> References: <1457965120-3155420-1-git-send-email-arnd@arndb.de> X-Provags-ID: V03:K0:W2UtQ8La++AGBSUuRysWk0inS4o+rmjlm379RCntvVcvF6rOANA bdy9Q1FkndBtbU+qg7PLZ0mZtcOki9euaXHjiMZWmwvf6czIeRgRRWfg5WUZ2Tb9nk1IRDd HQd2pXZ4Ox6/5ZcUbnCKgrpO4Qb5xigXgo6kQfOSRzC+tPjtlwt9nwxLx2/Ox5jiH8iDxQs Ha/BU5C15HlP3vJyuy33A== X-UI-Out-Filterresults: notjunk:1; V01:K0:2vBQcCGmBTM=:Z57RblR00L6SWK4ekvZcM+ re4hj8ZOd9Yq2jhV0S0eRQ5cC8zD6lUSbkfFYG0ghC1j7rErxzA+b44t4hqdgOCjsf8I1hXEH yMovkfBYoHTFYaOTX8OvKMkBQVmYfNfzvcrSQTjGrmF5747FsFOxICnq9w/Y7++AoO2UbBZr1 DTZ/XME9IUY4Kuznj7xYVRkAWrGgwbEOXGTN69pgfKZPKxRs8Fw8/u2orVaPv/gkFP3obMchy jICm//fPrmNZ49Q4LR25x2Y/4bBXpsipLitWl1gQAAFeq3j3VkQaJn4QPjp39JlvJ7jZpM2Lt t3C5bYwTZgmMWDBdxr8qhRB2SE7bE/Kn0876TuUG8ziRMa9uJ3tkZ7eJBSmIFlrvKWfGRdfpJ V+Vn34ZJEzDap5lq/Lsm+l3JAmnwXxOf29UzelHuCIMvApok+V+Fe1GWAaNzrBYNVUbJbuV9F UtZs5NYvDXskahg5DOohkQZALZc+3LXGv5+s6CEzAA8i/eWMYe78A7lJJuBGUoxGyT4eSl394 dhMzEIDQtLPhq0JdssUbU2qXZPGzMEOlbY5cCQnAJ1OM4HZaGnjnZ+iSO47tNvP9YASaZhUcx RadMnSrRd/Y2ebHErzKdbHu8PObxjBHizQugsDBO6cn1ZQbwEREpcoLxxDvnHqLkYd40W2Pq7 LZ4whk7SqGcQHr1D9IUO5tIFGUiJkN7ZpQQv+KpH8icM9E5z3jVNC4WpcZF9n8Wl/8Vk= Sender: linux-kernel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org gcc-6 finds an out of bounds access in the fst_add_one function when calculating the end of the mmio area: drivers/net/wan/farsync.c: In function 'fst_add_one': drivers/net/wan/farsync.c:418:53: error: index 2 denotes an offset greater than size of 'u8[2][8192] {aka unsigned char[2][8192]}' [-Werror=array-bounds] #define BUF_OFFSET(X) (BFM_BASE + offsetof(struct buf_window, X)) ^ include/linux/compiler-gcc.h:158:21: note: in definition of macro '__compiler_offsetof' __builtin_offsetof(a, b) ^ drivers/net/wan/farsync.c:418:37: note: in expansion of macro 'offsetof' #define BUF_OFFSET(X) (BFM_BASE + offsetof(struct buf_window, X)) ^~~~~~~~ drivers/net/wan/farsync.c:2519:36: note: in expansion of macro 'BUF_OFFSET' + BUF_OFFSET ( txBuffer[i][NUM_TX_BUFFER][0]); ^~~~~~~~~~ The warning is correct, but not critical because this appears to be a write-only variable that is set by each WAN driver but never accessed afterwards. I'm taking the minimal fix here, using the correct pointer by pointing 'mem_end' to the last byte inside of the register area as all other WAN drivers do, rather than the first byte outside of it. An alternative would be to just remove the mem_end member entirely. Signed-off-by: Arnd Bergmann --- drivers/net/wan/farsync.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) -- 2.7.0 diff --git a/drivers/net/wan/farsync.c b/drivers/net/wan/farsync.c index 44541dbc5c28..69b994f3b8c5 100644 --- a/drivers/net/wan/farsync.c +++ b/drivers/net/wan/farsync.c @@ -2516,7 +2516,7 @@ fst_add_one(struct pci_dev *pdev, const struct pci_device_id *ent) dev->mem_start = card->phys_mem + BUF_OFFSET ( txBuffer[i][0][0]); dev->mem_end = card->phys_mem - + BUF_OFFSET ( txBuffer[i][NUM_TX_BUFFER][0]); + + BUF_OFFSET ( txBuffer[i][NUM_TX_BUFFER - 1][LEN_RX_BUFFER - 1]); dev->base_addr = card->pci_conf; dev->irq = card->irq;