| Message ID | Y+D+KN18FQI2DKLq@kili (mailing list archive) |
|---|---|
| State | Accepted |
| Commit | 9cec2aaffe969f2a3e18b5ec105fc20bb908e475 |
| Delegated to: | Netdev Maintainers |
| Headers | show |
| Series | [net-next] net: sched: sch: Fix off by one in htb_activate_prios() | expand |
On Mon, Feb 06, 2023 at 04:18:32PM +0300, Dan Carpenter wrote: > The > needs be >= to prevent an out of bounds access. > > Fixes: de5ca4c3852f ("net: sched: sch: Bounds check priority") > Signed-off-by: Dan Carpenter <error27@gmail.com> Reviewed-by: Simon Horman <simon.horman@corigine.com>
On Mon, Feb 06, 2023 at 04:18:32PM +0300, Dan Carpenter wrote: > The > needs be >= to prevent an out of bounds access. > > Fixes: de5ca4c3852f ("net: sched: sch: Bounds check priority") > Signed-off-by: Dan Carpenter <error27@gmail.com> > --- > net/sched/sch_htb.c | 2 +- > 1 file changed, 1 insertion(+), 1 deletion(-) > > diff --git a/net/sched/sch_htb.c b/net/sched/sch_htb.c > index cc28e41fb745..92f2975b6a82 100644 > --- a/net/sched/sch_htb.c > +++ b/net/sched/sch_htb.c > @@ -433,7 +433,7 @@ static void htb_activate_prios(struct htb_sched *q, struct htb_class *cl) > while (m) { > unsigned int prio = ffz(~m); > > - if (WARN_ON_ONCE(prio > ARRAY_SIZE(p->inner.clprio))) > + if (WARN_ON_ONCE(prio >= ARRAY_SIZE(p->inner.clprio))) Argh, whoops. Thanks Dan! Reviewed-by: Kees Cook <keescook@chromium.org>
On Mon, 6 Feb 2023 16:18:32 +0300 Dan Carpenter wrote: > Subject: [PATCH net-next] net: sched: sch: Fix off by one in htb_activate_prios() Thanks for tagging but just to be sure - this is for net, right? (no need to repost) > The > needs be >= to prevent an out of bounds access. > > Fixes: de5ca4c3852f ("net: sched: sch: Bounds check priority")
On Tue, Feb 07, 2023 at 08:16:03PM -0800, Jakub Kicinski wrote: > On Mon, 6 Feb 2023 16:18:32 +0300 Dan Carpenter wrote: > > Subject: [PATCH net-next] net: sched: sch: Fix off by one in htb_activate_prios() > > Thanks for tagging but just to be sure - this is for net, right? > (no need to repost) > Yes. And I did verify before sending that it applied to net, but I still put net-next in the subject because I'm an idiot. regards, dan carpenter
Hello: This patch was applied to netdev/net.git (master) by Jakub Kicinski <kuba@kernel.org>: On Mon, 6 Feb 2023 16:18:32 +0300 you wrote: > The > needs be >= to prevent an out of bounds access. > > Fixes: de5ca4c3852f ("net: sched: sch: Bounds check priority") > Signed-off-by: Dan Carpenter <error27@gmail.com> > --- > net/sched/sch_htb.c | 2 +- > 1 file changed, 1 insertion(+), 1 deletion(-) Here is the summary with links: - [net-next] net: sched: sch: Fix off by one in htb_activate_prios() https://git.kernel.org/netdev/net/c/9cec2aaffe96 You are awesome, thank you!
diff --git a/net/sched/sch_htb.c b/net/sched/sch_htb.c index cc28e41fb745..92f2975b6a82 100644 --- a/net/sched/sch_htb.c +++ b/net/sched/sch_htb.c @@ -433,7 +433,7 @@ static void htb_activate_prios(struct htb_sched *q, struct htb_class *cl) while (m) { unsigned int prio = ffz(~m); - if (WARN_ON_ONCE(prio > ARRAY_SIZE(p->inner.clprio))) + if (WARN_ON_ONCE(prio >= ARRAY_SIZE(p->inner.clprio))) break; m &= ~(1 << prio);
The > needs be >= to prevent an out of bounds access. Fixes: de5ca4c3852f ("net: sched: sch: Bounds check priority") Signed-off-by: Dan Carpenter <error27@gmail.com> --- net/sched/sch_htb.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)