lkml.org 
[lkml]   [2022]   [Aug]   [23]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 5.19 220/365] net: dsa: sja1105: fix buffer overflow in sja1105_setup_devlink_regions()
    Date
    From: Rustam Subkhankulov <subkhankulov@ispras.ru>

    commit fd8e899cdb5ecaf8e8ee73854a99e10807eef1de upstream.

    If an error occurs in dsa_devlink_region_create(), then 'priv->regions'
    array will be accessed by negative index '-1'.

    Found by Linux Verification Center (linuxtesting.org) with SVACE.

    Signed-off-by: Rustam Subkhankulov <subkhankulov@ispras.ru>
    Fixes: bf425b82059e ("net: dsa: sja1105: expose static config as devlink region")
    Link: https://lore.kernel.org/r/20220817003845.389644-1-subkhankulov@ispras.ru
    Signed-off-by: Jakub Kicinski <kuba@kernel.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    ---
    drivers/net/dsa/sja1105/sja1105_devlink.c | 2 +-
    1 file changed, 1 insertion(+), 1 deletion(-)

    --- a/drivers/net/dsa/sja1105/sja1105_devlink.c
    +++ b/drivers/net/dsa/sja1105/sja1105_devlink.c
    @@ -93,7 +93,7 @@ static int sja1105_setup_devlink_regions

    region = dsa_devlink_region_create(ds, ops, 1, size);
    if (IS_ERR(region)) {
    - while (i-- >= 0)
    + while (--i >= 0)
    dsa_devlink_region_destroy(priv->regions[i]);
    return PTR_ERR(region);
    }

    \
     
     \ /
      Last update: 2022-08-23 11:05    [W:4.059 / U:0.052 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site