diff options
| author | Dan Carpenter <dan.carpenter@oracle.com> | 2021-01-19 15:53:35 +0100 |
|---|---|---|
| committer | Jakub Kicinski <kuba@kernel.org> | 2021-01-21 02:10:04 +0100 |
| commit | 646188c9550f74454dfc172a347dad693e5bfc84 (patch) | |
| tree | 38879d905567fff39e9d594dfc6fad9e2d1e4e61 | |
| parent | Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net (diff) | |
| download | linux-646188c9550f74454dfc172a347dad693e5bfc84.tar.xz linux-646188c9550f74454dfc172a347dad693e5bfc84.zip | |
net: dsa: Fix off by one in dsa_loop_port_vlan_add()
The > comparison is intended to be >= to prevent reading beyond the
end of the ps->vlans[] array. It doesn't affect run time though because
the ps->vlans[] array has VLAN_N_VID (4096) elements and the vlan->vid
cannot be > 4094 because it is checked earlier.
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Acked-by: Florian Fainelli <f.fainelli@gmail.com>
Link: https://lore.kernel.org/r/YAbyb5kBJQlpYCs2@mwanda
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
| -rw-r--r-- | drivers/net/dsa/dsa_loop.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/drivers/net/dsa/dsa_loop.c b/drivers/net/dsa/dsa_loop.c index 5f69216376fe..8c283f59158b 100644 --- a/drivers/net/dsa/dsa_loop.c +++ b/drivers/net/dsa/dsa_loop.c @@ -207,7 +207,7 @@ static int dsa_loop_port_vlan_add(struct dsa_switch *ds, int port, struct mii_bus *bus = ps->bus; struct dsa_loop_vlan *vl; - if (vlan->vid > ARRAY_SIZE(ps->vlans)) + if (vlan->vid >= ARRAY_SIZE(ps->vlans)) return -ERANGE; /* Just do a sleeping operation to make lockdep checks effective */ |