lkml.org 
[lkml]   [2020]   [Mar]   [17]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 5.4 025/123] net: systemport: fix index check to avoid an array out of bounds access
    Date
    From: Colin Ian King <colin.king@canonical.com>

    [ Upstream commit c0368595c1639947839c0db8294ee96aca0b3b86 ]

    Currently the bounds check on index is off by one and can lead to
    an out of bounds access on array priv->filters_loc when index is
    RXCHK_BRCM_TAG_MAX.

    Fixes: bb9051a2b230 ("net: systemport: Add support for WAKE_FILTER")
    Signed-off-by: Colin Ian King <colin.king@canonical.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    ---
    drivers/net/ethernet/broadcom/bcmsysport.c | 2 +-
    1 file changed, 1 insertion(+), 1 deletion(-)

    --- a/drivers/net/ethernet/broadcom/bcmsysport.c
    +++ b/drivers/net/ethernet/broadcom/bcmsysport.c
    @@ -2135,7 +2135,7 @@ static int bcm_sysport_rule_set(struct b
    return -ENOSPC;

    index = find_first_zero_bit(priv->filters, RXCHK_BRCM_TAG_MAX);
    - if (index > RXCHK_BRCM_TAG_MAX)
    + if (index >= RXCHK_BRCM_TAG_MAX)
    return -ENOSPC;

    /* Location is the classification ID, and index is the position

    \
     
     \ /
      Last update: 2020-03-17 12:01    [W:3.264 / U:0.632 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site