| Message ID | 20211109114736.GA16587@kili (mailing list archive) |
|---|---|
| State | Accepted |
| Commit | 1c360cc1cc883fbdf0a258b4df376571fbeac5ee |
| Delegated to: | Netdev Maintainers |
| Headers | show |
| Series | [net] gve: Fix off by one in gve_tx_timeout() | expand |
Hello: This patch was applied to netdev/net.git (master) by David S. Miller <davem@davemloft.net>: On Tue, 9 Nov 2021 14:47:36 +0300 you wrote: > The priv->ntfy_blocks[] has "priv->num_ntfy_blks" elements so this > > needs to be >= to prevent an off by one bug. The priv->ntfy_blocks[] > array is allocated in gve_alloc_notify_blocks(). > > Fixes: 87a7f321bb6a ("gve: Recover from queue stall due to missed IRQ") > Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> > > [...] Here is the summary with links: - [net] gve: Fix off by one in gve_tx_timeout() https://git.kernel.org/netdev/net/c/1c360cc1cc88 You are awesome, thank you!
diff --git a/drivers/net/ethernet/google/gve/gve_main.c b/drivers/net/ethernet/google/gve/gve_main.c index 7647cd05b1d2..2c091c99b81b 100644 --- a/drivers/net/ethernet/google/gve/gve_main.c +++ b/drivers/net/ethernet/google/gve/gve_main.c @@ -1137,7 +1137,7 @@ static void gve_tx_timeout(struct net_device *dev, unsigned int txqueue) goto reset; ntfy_idx = gve_tx_idx_to_ntfy(priv, txqueue); - if (ntfy_idx > priv->num_ntfy_blks) + if (ntfy_idx >= priv->num_ntfy_blks) goto reset; block = &priv->ntfy_blocks[ntfy_idx];
The priv->ntfy_blocks[] has "priv->num_ntfy_blks" elements so this > needs to be >= to prevent an off by one bug. The priv->ntfy_blocks[] array is allocated in gve_alloc_notify_blocks(). Fixes: 87a7f321bb6a ("gve: Recover from queue stall due to missed IRQ") Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> --- drivers/net/ethernet/google/gve/gve_main.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)