My static checker complains that this could corrupt memory. It
seems valid to add a range check here.
Signed-off-by: Dan Carpenter <dan.carpenter@xxxxxxxxxx>
---
I can't test this.
diff --git a/drivers/infiniband/hw/ipath/ipath_verbs.c b/drivers/infiniband/hw/ipath/ipath_verbs.c
index 439c35d..f15dd70 100644
--- a/drivers/infiniband/hw/ipath/ipath_verbs.c
+++ b/drivers/infiniband/hw/ipath/ipath_verbs.c
@@ -621,6 +621,10 @@ void ipath_ib_rcv(struct ipath_ibdev *dev, void *rhdr, void *data,
}
opcode = be32_to_cpu(ohdr->bth[0]) >> 24;
+ if (opcode >= ARRAY_SIZE(dev->opstats)) {
+ dev->rcv_errors++;
+ goto bail;
+ }
dev->opstats[opcode].n_bytes += tlen;
dev->opstats[opcode].n_packets++;
--
To unsubscribe from this list: send the line "unsubscribe kernel-janitors" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
