1. 26 2月, 2008 2 次提交
  2. 19 2月, 2008 1 次提交
    • R
      RDMA/nes: Fix possible array overrun · 51af33e8
      Roland Dreier 提交于
      In nes_create_qp(), the test
      
      	if (nesqp->mmap_sq_db_index > NES_MAX_USER_WQ_REGIONS) {
      
      is used to error out if the db_index is too large; however, if the
      test doesn't trigger, then the index is used as
      
      	nes_ucontext->mmap_nesqp[nesqp->mmap_sq_db_index] = nesqp;
      
      and mmap_nesqp is declared as
      
      	struct nes_qp      *mmap_nesqp[NES_MAX_USER_WQ_REGIONS];
      
      which leads to an array overrun if the index is exactly equal to
      NES_MAX_USER_WQ_REGIONS.  Fix this by bailing out if the index is
      greater than or equal to NES_MAX_USER_WQ_REGIONS.
      
      This was spotted by the Coverity checker (CID 2162).
      Acked-by: NGlenn Streiff <gstreiff@neteffect.com>
      Signed-off-by: NRoland Dreier <rolandd@cisco.com>
      51af33e8
  3. 05 2月, 2008 1 次提交