Skip to content

Commit eefa531

Browse files
GustavoARSilvakuba-moo
authored andcommitted
ixgbe: Fix out-bounds warning in ixgbe_host_interface_command()
Replace union with a couple of pointers in order to fix the following out-of-bounds warning: CC [M] drivers/net/ethernet/intel/ixgbe/ixgbe_common.o drivers/net/ethernet/intel/ixgbe/ixgbe_common.c: In function ‘ixgbe_host_interface_command’: drivers/net/ethernet/intel/ixgbe/ixgbe_common.c:3729:13: warning: array subscript 1 is above array bounds of ‘u32[1]’ {aka ‘unsigned int[1]’} [-Warray-bounds] 3729 | bp->u32arr[bi] = IXGBE_READ_REG_ARRAY(hw, IXGBE_FLEX_MNG, bi); | ~~~~~~~~~~^~~~ drivers/net/ethernet/intel/ixgbe/ixgbe_common.c:3682:7: note: while referencing ‘u32arr’ 3682 | u32 u32arr[1]; | ^~~~~~ This helps with the ongoing efforts to globally enable -Warray-bounds. Link: KSPP/linux#109 Co-developed-by: Kees Cook <[email protected]> Signed-off-by: Kees Cook <[email protected]> Signed-off-by: Gustavo A. R. Silva <[email protected]> Tested-by: Dave Switzer <[email protected]> Signed-off-by: Tony Nguyen <[email protected]> Link: https://lore.kernel.org/r/[email protected] Signed-off-by: Jakub Kicinski <[email protected]>
1 parent cf5e129 commit eefa531

File tree

1 file changed

+7
-9
lines changed

1 file changed

+7
-9
lines changed

drivers/net/ethernet/intel/ixgbe/ixgbe_common.c

Lines changed: 7 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -3678,10 +3678,8 @@ s32 ixgbe_host_interface_command(struct ixgbe_hw *hw, void *buffer,
36783678
bool return_data)
36793679
{
36803680
u32 hdr_size = sizeof(struct ixgbe_hic_hdr);
3681-
union {
3682-
struct ixgbe_hic_hdr hdr;
3683-
u32 u32arr[1];
3684-
} *bp = buffer;
3681+
struct ixgbe_hic_hdr *hdr = buffer;
3682+
u32 *u32arr = buffer;
36853683
u16 buf_len, dword_len;
36863684
s32 status;
36873685
u32 bi;
@@ -3707,12 +3705,12 @@ s32 ixgbe_host_interface_command(struct ixgbe_hw *hw, void *buffer,
37073705

37083706
/* first pull in the header so we know the buffer length */
37093707
for (bi = 0; bi < dword_len; bi++) {
3710-
bp->u32arr[bi] = IXGBE_READ_REG_ARRAY(hw, IXGBE_FLEX_MNG, bi);
3711-
le32_to_cpus(&bp->u32arr[bi]);
3708+
u32arr[bi] = IXGBE_READ_REG_ARRAY(hw, IXGBE_FLEX_MNG, bi);
3709+
le32_to_cpus(&u32arr[bi]);
37123710
}
37133711

37143712
/* If there is any thing in data position pull it in */
3715-
buf_len = bp->hdr.buf_len;
3713+
buf_len = hdr->buf_len;
37163714
if (!buf_len)
37173715
goto rel_out;
37183716

@@ -3727,8 +3725,8 @@ s32 ixgbe_host_interface_command(struct ixgbe_hw *hw, void *buffer,
37273725

37283726
/* Pull in the rest of the buffer (bi is where we left off) */
37293727
for (; bi <= dword_len; bi++) {
3730-
bp->u32arr[bi] = IXGBE_READ_REG_ARRAY(hw, IXGBE_FLEX_MNG, bi);
3731-
le32_to_cpus(&bp->u32arr[bi]);
3728+
u32arr[bi] = IXGBE_READ_REG_ARRAY(hw, IXGBE_FLEX_MNG, bi);
3729+
le32_to_cpus(&u32arr[bi]);
37323730
}
37333731

37343732
rel_out:

0 commit comments

Comments
 (0)