Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux

IB/mad: Fix an array index check

The array ib_mad_mgmt_class_table.method_table has MAX_MGMT_CLASS
(80) elements. Hence compare the array index with that value instead
of with IB_MGMT_MAX_METHODS (128). This patch avoids that Coverity
reports the following:

Overrunning array class->method_table of 80 8-byte elements at element index 127 (byte offset 1016) using index convert_mgmt_class(mad_hdr->mgmt_class) (which evaluates to 127).

Fixes: commit b7ab0b19a85f ("IB/mad: Verify mgmt class in received MADs")
Signed-off-by: Bart Van Assche <bart.vanassche@sandisk.com>
Cc: Sean Hefty <sean.hefty@intel.com>
Cc: <stable@vger.kernel.org>
Reviewed-by: Hal Rosenstock <hal@mellanox.com>
Signed-off-by: Doug Ledford <dledford@redhat.com>

authored by

Bart Van Assche and committed by
Doug Ledford
2fe2f378 0d38c240

+1 -1
+1 -1
drivers/infiniband/core/mad.c
··· 1746 1746 if (!class) 1747 1747 goto out; 1748 1748 if (convert_mgmt_class(mad_hdr->mgmt_class) >= 1749 - IB_MGMT_MAX_METHODS) 1749 + ARRAY_SIZE(class->method_table)) 1750 1750 goto out; 1751 1751 method = class->method_table[convert_mgmt_class( 1752 1752 mad_hdr->mgmt_class)];