Commit 2378b2c9 authored by Dan Carpenter's avatar Dan Carpenter Committed by David S. Miller

octeontx2-af: cn10k: fix an array overflow in is_lmac_valid()

The value of "lmac_id" can be controlled by the user and if it is larger
then the number of bits in long then it reads outside the bitmap.
The highest valid value is less than MAX_LMAC_PER_CGX (4).

Fixes: 91c6945e ("octeontx2-af: cn10k: Add RPM MAC support")
Signed-off-by: default avatarDan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent 95b39f07
...@@ -56,7 +56,9 @@ static bool is_dev_rpm(void *cgxd) ...@@ -56,7 +56,9 @@ static bool is_dev_rpm(void *cgxd)
bool is_lmac_valid(struct cgx *cgx, int lmac_id) bool is_lmac_valid(struct cgx *cgx, int lmac_id)
{ {
return cgx && test_bit(lmac_id, &cgx->lmac_bmap); if (!cgx || lmac_id < 0 || lmac_id >= MAX_LMAC_PER_CGX)
return false;
return test_bit(lmac_id, &cgx->lmac_bmap);
} }
struct mac_ops *get_mac_ops(void *cgxd) struct mac_ops *get_mac_ops(void *cgxd)
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment