| Message ID | YAbxI97Dl/pmBy5V@mwanda (mailing list archive) |
|---|---|
| State | Accepted |
| Delegated to: | Netdev Maintainers |
| Headers | show |
| Series | [net] net: dsa: b53: fix an off by one in checking "vlan->vid" | expand |
| Context | Check | Description |
|---|---|---|
| netdev/cover_letter | success | Link |
| netdev/fixes_present | success | Link |
| netdev/patch_count | success | Link |
| netdev/tree_selection | success | Clearly marked for net |
| netdev/subject_prefix | success | Link |
| netdev/cc_maintainers | success | CCed 7 of 7 maintainers |
| netdev/source_inline | success | Was 0 now: 0 |
| netdev/verify_signedoff | success | Link |
| netdev/module_param | success | Was 0 now: 0 |
| netdev/build_32bit | success | Errors and warnings before: 0 this patch: 0 |
| netdev/kdoc | success | Errors and warnings before: 0 this patch: 0 |
| netdev/verify_fixes | success | Link |
| netdev/checkpatch | success | total: 0 errors, 0 warnings, 0 checks, 8 lines checked |
| netdev/build_allmodconfig_warn | success | Errors and warnings before: 0 this patch: 0 |
| netdev/header_inline | success | Link |
| netdev/stable | success | Stable not CCed |
On 1/19/2021 6:48 AM, Dan Carpenter wrote: > The > comparison should be >= to prevent accessing one element beyond > the end of the dev->vlans[] array in the caller function, b53_vlan_add(). > The "dev->vlans" array is allocated in the b53_switch_init() function > and it has "dev->num_vlans" elements. > > Fixes: a2482d2ce349 ("net: dsa: b53: Plug in VLAN support") > Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> Acked-by: Florian Fainelli <f.fainelli@gmail.com>
On Tue, 19 Jan 2021 09:14:03 -0800 Florian Fainelli wrote: > On 1/19/2021 6:48 AM, Dan Carpenter wrote: > > The > comparison should be >= to prevent accessing one element beyond > > the end of the dev->vlans[] array in the caller function, b53_vlan_add(). > > The "dev->vlans" array is allocated in the b53_switch_init() function > > and it has "dev->num_vlans" elements. > > > > Fixes: a2482d2ce349 ("net: dsa: b53: Plug in VLAN support") > > Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> > > Acked-by: Florian Fainelli <f.fainelli@gmail.com> Applied, thanks!
diff --git a/drivers/net/dsa/b53/b53_common.c b/drivers/net/dsa/b53/b53_common.c index 288b5a5c3e0d..95c7fa171e35 100644 --- a/drivers/net/dsa/b53/b53_common.c +++ b/drivers/net/dsa/b53/b53_common.c @@ -1404,7 +1404,7 @@ int b53_vlan_prepare(struct dsa_switch *ds, int port, !(vlan->flags & BRIDGE_VLAN_INFO_UNTAGGED)) return -EINVAL; - if (vlan->vid_end > dev->num_vlans) + if (vlan->vid_end >= dev->num_vlans) return -ERANGE; b53_enable_vlan(dev, true, ds->vlan_filtering);
The > comparison should be >= to prevent accessing one element beyond the end of the dev->vlans[] array in the caller function, b53_vlan_add(). The "dev->vlans" array is allocated in the b53_switch_init() function and it has "dev->num_vlans" elements. Fixes: a2482d2ce349 ("net: dsa: b53: Plug in VLAN support") Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> --- drivers/net/dsa/b53/b53_common.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)