diff mbox series

RDMA/mlx5: Signedness bug in UVERBS_HANDLER()

Message ID 20181222074332.GA7662@kadam (mailing list archive)
State Accepted
Commit 58f7c0bfb4e111006ba376df7ab266a6d42d64ba
Delegated to: Jason Gunthorpe
Headers show
Series RDMA/mlx5: Signedness bug in UVERBS_HANDLER() | expand

Commit Message

Dan Carpenter Dec. 22, 2018, 7:43 a.m. UTC
The "num_actions" variable needs to be signed for the error handling to
work.  The maximum number of actions is less than 256 so int type is
large enough for that.

Fixes: cbfdd442c43e ("IB/uverbs: Add helper to get array size from ptr attribute")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
---
 drivers/infiniband/hw/mlx5/flow.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

Comments

Leon Romanovsky Dec. 22, 2018, 8:37 a.m. UTC | #1
On Sat, Dec 22, 2018 at 10:43:32AM +0300, Dan Carpenter wrote:
> The "num_actions" variable needs to be signed for the error handling to
> work.  The maximum number of actions is less than 256 so int type is
> large enough for that.
>
> Fixes: cbfdd442c43e ("IB/uverbs: Add helper to get array size from ptr attribute")
> Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
> ---
>  drivers/infiniband/hw/mlx5/flow.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
>

Thanks,
Acked-by: Leon Romanovsky <leonro@mellanox.com>
Jason Gunthorpe Dec. 22, 2018, 11:09 p.m. UTC | #2
On Sat, Dec 22, 2018 at 10:43:32AM +0300, Dan Carpenter wrote:
> The "num_actions" variable needs to be signed for the error handling to
> work.  The maximum number of actions is less than 256 so int type is
> large enough for that.
> 
> Fixes: cbfdd442c43e ("IB/uverbs: Add helper to get array size from ptr attribute")
> Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
> Acked-by: Leon Romanovsky <leonro@mellanox.com>
> ---
>  drivers/infiniband/hw/mlx5/flow.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)

Applied to for-next

Thanks,
Jason
diff mbox series

Patch

diff --git a/drivers/infiniband/hw/mlx5/flow.c b/drivers/infiniband/hw/mlx5/flow.c
index 95cf4b9fc65d..e8a1e4498e3f 100644
--- a/drivers/infiniband/hw/mlx5/flow.c
+++ b/drivers/infiniband/hw/mlx5/flow.c
@@ -329,7 +329,7 @@  static int UVERBS_HANDLER(MLX5_IB_METHOD_FLOW_ACTION_CREATE_MODIFY_HEADER)(
 	struct mlx5_ib_dev *mdev = to_mdev(uobj->context->device);
 	enum mlx5_ib_uapi_flow_table_type ft_type;
 	struct ib_flow_action *action;
-	size_t num_actions;
+	int num_actions;
 	void *in;
 	int ret;