Commit 9810c58c authored by Dan Carpenter's avatar Dan Carpenter Committed by David S. Miller

net: lan966x: fix a couple off by one bugs

The lan966x->ports[] array has lan966x->num_phys_ports elements.  These
are assigned in lan966x_probe().  That means the > comparison should be
changed to >=.

The first off by one check is harmless but the second one could lead to
an out of bounds access and a crash.

Fixes: 5ccd66e0 ("net: lan966x: add support for interrupts from analyzer")
Signed-off-by: default avatarDan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent 4e2e65e2
...@@ -346,7 +346,7 @@ static void lan966x_mac_irq_process(struct lan966x *lan966x, u32 row, ...@@ -346,7 +346,7 @@ static void lan966x_mac_irq_process(struct lan966x *lan966x, u32 row,
lan966x_mac_process_raw_entry(&raw_entries[column], lan966x_mac_process_raw_entry(&raw_entries[column],
mac, &vid, &dest_idx); mac, &vid, &dest_idx);
if (WARN_ON(dest_idx > lan966x->num_phys_ports)) if (WARN_ON(dest_idx >= lan966x->num_phys_ports))
continue; continue;
/* If the entry in SW is found, then there is nothing /* If the entry in SW is found, then there is nothing
...@@ -393,7 +393,7 @@ static void lan966x_mac_irq_process(struct lan966x *lan966x, u32 row, ...@@ -393,7 +393,7 @@ static void lan966x_mac_irq_process(struct lan966x *lan966x, u32 row,
lan966x_mac_process_raw_entry(&raw_entries[column], lan966x_mac_process_raw_entry(&raw_entries[column],
mac, &vid, &dest_idx); mac, &vid, &dest_idx);
if (WARN_ON(dest_idx > lan966x->num_phys_ports)) if (WARN_ON(dest_idx >= lan966x->num_phys_ports))
continue; continue;
mac_entry = lan966x_mac_alloc_entry(mac, vid, dest_idx); mac_entry = lan966x_mac_alloc_entry(mac, vid, dest_idx);
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment