On 6/2/25 10:57 AM, Anastasia Belova wrote:
> s->pool has n_descs elements so maximum i should be
> n_descs - 1. Fix the upper bound.
>
> Found by Linux Verification Center (linuxtesting.org) with SVACE.
>
> Fixes: cb039ef3d9 ("net: add initial support for AF_XDP network backend")
> Signed-off-by: Anastasia Belova <nabelov...@gmail.com>
> ---
> net/af-xdp.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/net/af-xdp.c b/net/af-xdp.c
> index 01c5fb914e..d022534d76 100644
> --- a/net/af-xdp.c
> +++ b/net/af-xdp.c
> @@ -323,7 +323,7 @@ static int af_xdp_umem_create(AFXDPState *s, int sock_fd,
> Error **errp)
>
> s->pool = g_new(uint64_t, n_descs);
> /* Fill the pool in the opposite order, because it's a LIFO queue. */
> - for (i = n_descs; i >= 0; i--) {
> + for (i = n_descs - 1; i >= 0; i--) {
> s->pool[i] = i * XSK_UMEM__DEFAULT_FRAME_SIZE;
> }
> s->n_pool = n_descs;
As far as the fix goes:
Reviewed-by: Ilya Maximets <i.maxim...@ovn.org>
The loop itself though doesn't do what the comment says it should be doing,
but it's not related to this fix. I'll send a separate patch for that.
