Commit eefa5311 authored May 27, 2021 by Gustavo A. R. Silva Committed by Jakub Kicinski May 27, 2021

ixgbe: Fix out-bounds warning in ixgbe_host_interface_command()

Replace union with a couple of pointers in order to fix the following
out-of-bounds warning:

  CC [M]  drivers/net/ethernet/intel/ixgbe/ixgbe_common.o
drivers/net/ethernet/intel/ixgbe/ixgbe_common.c: In function ‘ixgbe_host_interface_command’:
drivers/net/ethernet/intel/ixgbe/ixgbe_common.c:3729:13: warning: array subscript 1 is above array bounds of ‘u32[1]’ {aka ‘unsigned int[1]’} [-Warray-bounds]
 3729 |   bp->u32arr[bi] = IXGBE_READ_REG_ARRAY(hw, IXGBE_FLEX_MNG, bi);
      |   ~~~~~~~~~~^~~~
drivers/net/ethernet/intel/ixgbe/ixgbe_common.c:3682:7: note: while referencing ‘u32arr’
 3682 |   u32 u32arr[1];
      |       ^~~~~~

This helps with the ongoing efforts to globally enable -Warray-bounds.

Link: https://github.com/KSPP/linux/issues/109


Co-developed-by: Kees Cook <keescook@chromium.org>
Signed-off-by: Kees Cook <keescook@chromium.org>
Signed-off-by: Gustavo A. R. Silva <gustavoars@kernel.org>
Tested-by: Dave Switzer <david.switzer@intel.com>
Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
Link: https://lore.kernel.org/r/20210527173424.362456-1-anthony.l.nguyen@intel.com


Signed-off-by: Jakub Kicinski <kuba@kernel.org>

parent cf5e1297

drivers/net/ethernet/intel/ixgbe/ixgbe_common.c

+7 −9

Original line number	Diff line number	Diff line
		@@ -3678,10 +3678,8 @@ s32 ixgbe_host_interface_command(struct ixgbe_hw hw, void buffer,
		bool return_data)
		{
		u32 hdr_size = sizeof(struct ixgbe_hic_hdr);
		union {
		struct ixgbe_hic_hdr hdr;
		u32 u32arr[1];
		} *bp = buffer;
		struct ixgbe_hic_hdr *hdr = buffer;
		u32 *u32arr = buffer;
		u16 buf_len, dword_len;
		s32 status;
		u32 bi;
		@@ -3707,12 +3705,12 @@ s32 ixgbe_host_interface_command(struct ixgbe_hw hw, void buffer,

		/* first pull in the header so we know the buffer length */
		for (bi = 0; bi < dword_len; bi++) {
		bp->u32arr[bi] = IXGBE_READ_REG_ARRAY(hw, IXGBE_FLEX_MNG, bi);
		le32_to_cpus(&bp->u32arr[bi]);
		u32arr[bi] = IXGBE_READ_REG_ARRAY(hw, IXGBE_FLEX_MNG, bi);
		le32_to_cpus(&u32arr[bi]);
		}

		/* If there is any thing in data position pull it in */
		buf_len = bp->hdr.buf_len;
		buf_len = hdr->buf_len;
		if (!buf_len)
		goto rel_out;

		@@ -3727,8 +3725,8 @@ s32 ixgbe_host_interface_command(struct ixgbe_hw hw, void buffer,

		/* Pull in the rest of the buffer (bi is where we left off) */
		for (; bi <= dword_len; bi++) {
		bp->u32arr[bi] = IXGBE_READ_REG_ARRAY(hw, IXGBE_FLEX_MNG, bi);
		le32_to_cpus(&bp->u32arr[bi]);
		u32arr[bi] = IXGBE_READ_REG_ARRAY(hw, IXGBE_FLEX_MNG, bi);
		le32_to_cpus(&u32arr[bi]);
		}

		rel_out: