Messages in this thread | | | Date | Fri, 24 Nov 2023 17:58:30 +0000 | From | Simon Horman <> | Subject | Re: [PATCH] octeontx2-af: Fix possible buffer overflow |
| |
On Thu, Nov 23, 2023 at 08:36:30PM +0300, Elena Salomatkina wrote: > A loop in rvu_mbox_handler_nix_bandprof_free() contains > a break if (idx == MAX_BANDPROF_PER_PFFUNC), > but if idx may reach MAX_BANDPROF_PER_PFFUNC > buffer '(*req->prof_idx)[layer]' overflow happens before that check. > > The patch moves the break to the > beginning of the loop. > > Found by Linux Verification Center (linuxtesting.org) with SVACE. > > Fixes: e8e095b3b370 ("octeontx2-af: cn10k: Bandwidth profiles config support"). > Signed-off-by: Elena Salomatkina <elena.salomatkina.cmc@gmail.com>
Thanks Elena,
I agree with your analysis and that this seems to be an appropriate fix for the problem.
As this is a fix, it should be targeted at the net, as opposed to net-next, tree. Please keep this in mind for future patch submissions.
Subject: [PATCH net] ...
Link https://docs.kernel.org/process/maintainer-netdev.html
The above nit notwithstanding,
Reviewed-by: Simon Horman <horms@kernel.org>
| |