tech-kern archive

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index][Old Index]

Comparison of different-width ints in ixg(4)



Hello.

I ran a SAST tool, CodeQL, against trunk and found a couple of
instances (below) where the 16-bit integer `i` is compared to the
32-bit integer `max_rx_queues` or `max_tx_queues` in ixg(4). If
`max_rx_queues` (or `max_tx_queues`) is sufficiently large, it could
lead to an infinite loop.

sys/dev/pci/ixgbe/ixgbe_vf.c:280
sys/dev/pci/ixgbe/ixgbe_vf.c:284
sys/dev/pci/ixgbe/ixgbe_common.c:1158
sys/dev/pci/ixgbe/ixgbe_common.c:1162

**NOTE: this patch needs to be tested, as I have not tested it beyond
re-compiling the kernel.**

diff --git a/sys/dev/pci/ixgbe/ixgbe_common.c b/sys/dev/pci/ixgbe/ixgbe_common.c
index 04aac162f..b3b14e263 100644
--- a/sys/dev/pci/ixgbe/ixgbe_common.c
+++ b/sys/dev/pci/ixgbe/ixgbe_common.c
@@ -1115,7 +1115,7 @@ void ixgbe_set_lan_id_multi_port_pcie(struct ixgbe_hw *hw)
 s32 ixgbe_stop_adapter_generic(struct ixgbe_hw *hw)
 {
        u32 reg_val;
-       u16 i;
+       u32 i;

        DEBUGFUNC("ixgbe_stop_adapter_generic");

diff --git a/sys/dev/pci/ixgbe/ixgbe_vf.c b/sys/dev/pci/ixgbe/ixgbe_vf.c
index 63fceacdd..924ac2963 100644
--- a/sys/dev/pci/ixgbe/ixgbe_vf.c
+++ b/sys/dev/pci/ixgbe/ixgbe_vf.c
@@ -262,7 +262,7 @@ s32 ixgbe_reset_hw_vf(struct ixgbe_hw *hw)
 s32 ixgbe_stop_adapter_vf(struct ixgbe_hw *hw)
 {
        u32 reg_val;
-       u16 i;
+       u32 i;

        /*
         * Set the adapter_stopped flag so other driver functions stop touching


Home | Main Index | Thread Index | Old Index