| Message ID | 20241015130255.125508-1-kory.maincent@bootlin.com (mailing list archive) |
|---|---|
| State | Accepted |
| Commit | f2767a41959e60763949c73ee180e40c686e807e |
| Delegated to: | Netdev Maintainers |
| Headers | show |
| Series | [net] net: pse-pd: Fix out of bound for loop | expand |
On Tue, Oct 15, 2024 at 03:02:54PM +0200, Kory Maincent wrote: > Adjust the loop limit to prevent out-of-bounds access when iterating over > PI structures. The loop should not reach the index pcdev->nr_lines since > we allocate exactly pcdev->nr_lines number of PI structures. This fix > ensures proper bounds are maintained during iterations. > > Fixes: 9be9567a7c59 ("net: pse-pd: Add support for PSE PIs") > Signed-off-by: Kory Maincent <kory.maincent@bootlin.com> Reviewed-by: Simon Horman <horms@kernel.org>
On Tue, Oct 15, 2024 at 03:02:54PM +0200, Kory Maincent wrote: > Adjust the loop limit to prevent out-of-bounds access when iterating over > PI structures. The loop should not reach the index pcdev->nr_lines since > we allocate exactly pcdev->nr_lines number of PI structures. This fix > ensures proper bounds are maintained during iterations. > > Fixes: 9be9567a7c59 ("net: pse-pd: Add support for PSE PIs") > Signed-off-by: Kory Maincent <kory.maincent@bootlin.com> Acked-by: Oleksij Rempel <o.rempel@pengutronix.de> Thank you!
Hello: This patch was applied to netdev/net.git (main) by Andrew Lunn <andrew@lunn.ch>: On Tue, 15 Oct 2024 15:02:54 +0200 you wrote: > Adjust the loop limit to prevent out-of-bounds access when iterating over > PI structures. The loop should not reach the index pcdev->nr_lines since > we allocate exactly pcdev->nr_lines number of PI structures. This fix > ensures proper bounds are maintained during iterations. > > Fixes: 9be9567a7c59 ("net: pse-pd: Add support for PSE PIs") > Signed-off-by: Kory Maincent <kory.maincent@bootlin.com> > > [...] Here is the summary with links: - [net] net: pse-pd: Fix out of bound for loop https://git.kernel.org/netdev/net/c/f2767a41959e You are awesome, thank you!
diff --git a/drivers/net/pse-pd/pse_core.c b/drivers/net/pse-pd/pse_core.c index f8e6854781e6..2906ce173f66 100644 --- a/drivers/net/pse-pd/pse_core.c +++ b/drivers/net/pse-pd/pse_core.c @@ -113,7 +113,7 @@ static void pse_release_pis(struct pse_controller_dev *pcdev) { int i; - for (i = 0; i <= pcdev->nr_lines; i++) { + for (i = 0; i < pcdev->nr_lines; i++) { of_node_put(pcdev->pi[i].pairset[0].np); of_node_put(pcdev->pi[i].pairset[1].np); of_node_put(pcdev->pi[i].np); @@ -647,7 +647,7 @@ static int of_pse_match_pi(struct pse_controller_dev *pcdev, { int i; - for (i = 0; i <= pcdev->nr_lines; i++) { + for (i = 0; i < pcdev->nr_lines; i++) { if (pcdev->pi[i].np == np) return i; }
Adjust the loop limit to prevent out-of-bounds access when iterating over PI structures. The loop should not reach the index pcdev->nr_lines since we allocate exactly pcdev->nr_lines number of PI structures. This fix ensures proper bounds are maintained during iterations. Fixes: 9be9567a7c59 ("net: pse-pd: Add support for PSE PIs") Signed-off-by: Kory Maincent <kory.maincent@bootlin.com> --- drivers/net/pse-pd/pse_core.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)