Received: by 2002:a6b:500f:0:0:0:0:0 with SMTP id e15csp1787331iob; Thu, 5 May 2022 08:12:31 -0700 (PDT) X-Google-Smtp-Source: ABdhPJzi/oyFReBvFOh/qMssb85mN+gMF+6xV4QVHmSym5g3RoChBjUiqgBq63twXyALQQmUFuQl X-Received: by 2002:a17:907:9690:b0:6f3:bf14:4c68 with SMTP id hd16-20020a170907969000b006f3bf144c68mr26419385ejc.584.1651763551359; Thu, 05 May 2022 08:12:31 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1651763551; cv=none; d=google.com; s=arc-20160816; b=FvdySIWOgfpzM7nWGOwDh1xNJLAnIONNtUJXUsRDKKHwp8BRnJVYNuqIL5BJRIZ9Iq wC9hVecfRc2FXU3FEoAL5CB6KLELSgTPdOCM0/DkFTghQ0lVu8ErWcuEosBlN0htxMCr b+OrWnvx+cx6Ef+QySsHk+BGaNxbiTLKcMpetsB8ZLGkBsxhds6ZwbXiS7zohN24SLHr G9TKloyaC4VGQXBXMBM4smCRbiF6Yo/Zw2yCADskvWcVMF/I4YpjcpElZ1i4j2ilezNc RBZRV00JFoBW9MbtH52EDfNwo+qRr7AjZ4K27VkrMQzsthq4MifhLO7EaltS9RPn62qX 2J4w== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:content-transfer-encoding:mime-version :user-agent:references:in-reply-to:message-id:date:subject:cc:to :from:dkim-signature; bh=Gyo6xU2mcWpuW9GIxp21VFZhBHyuGztGtn6RsOMJ0XI=; b=r8p/jawjrWAX3arkane3xKG2In0n/f6tuib5ei9g3HJzPRH5rxC51LPKr2+Q7nHmNu QCPpCz5MnsqQ9hKdU3zAh/BtjEgOV77guGu5BPSxs8T/dF68w8O7ufQ7PSOuTVr25ZQo k83vf549UQXPng/I75jM8qhe9kB0Cti7vJHYx19kPe43kD+AS+7aKaZk0gHJuEPrhZAO pbOr6g+N/NA6E5Uh0LrwkNfuh9D9BdmU+fRBEle6Wm2wgXjOT29T0Ll8kcbRzoa0Rifi 0Qmydh/9Ewp1JjdVrpBtsXN1DS57AZK46BlGO2429qtnlfcbifwCjCYrBvGmNJzKnHjy 4Bjw== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@linuxfoundation.org header.s=korg header.b=ojVD+tbw; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linuxfoundation.org Return-Path: Received: from out1.vger.email (out1.vger.email. [2620:137:e000::1:20]) by mx.google.com with ESMTP id kw8-20020a170907770800b006df9153e00bsi2731838ejc.10.2022.05.05.08.12.05; Thu, 05 May 2022 08:12:31 -0700 (PDT) Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20; Authentication-Results: mx.google.com; dkim=pass header.i=@linuxfoundation.org header.s=korg header.b=ojVD+tbw; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linuxfoundation.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1353312AbiEDRqw (ORCPT + 99 others); Wed, 4 May 2022 13:46:52 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:40894 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1356437AbiEDRNn (ORCPT ); Wed, 4 May 2022 13:13:43 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id B09F54B874; Wed, 4 May 2022 09:57:59 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 813C661808; Wed, 4 May 2022 16:57:49 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id C9919C385AA; Wed, 4 May 2022 16:57:48 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1651683468; bh=f1LFHvJ8uk8SHhwLGhNDYMjw5ZoMM0XJ+6vYeOX3FRo=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=ojVD+tbwY8MjARWZ4ZOmv8YGxqPIYAkFg4Z3n9L/SNNJzvsD2ILkUNO9AmC/WlslO 3iTpdmXsaJcKWtPf9KJ4HV2dvz5tQMDoSRirwpmEam7ghb8yRht2MFu7mbMuosX6Tl mzFzY2LnxIp5LYfU9Z6B9dmZtawvG4SBSeWQqILI= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Dan Carpenter , "David S. Miller" , Sasha Levin Subject: [PATCH 5.17 120/225] net: lan966x: fix a couple off by one bugs Date: Wed, 4 May 2022 18:45:58 +0200 Message-Id: <20220504153121.194923229@linuxfoundation.org> X-Mailer: git-send-email 2.36.0 In-Reply-To: <20220504153110.096069935@linuxfoundation.org> References: <20220504153110.096069935@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit X-Spam-Status: No, score=-7.7 required=5.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,RCVD_IN_DNSWL_HI, SPF_HELO_NONE,SPF_PASS,T_SCC_BODY_TEXT_LINE autolearn=ham autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on lindbergh.monkeyblade.net Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: Dan Carpenter [ Upstream commit 9810c58c7051ae83e7ac326fca3daa823da6b778 ] The lan966x->ports[] array has lan966x->num_phys_ports elements. These are assigned in lan966x_probe(). That means the > comparison should be changed to >=. The first off by one check is harmless but the second one could lead to an out of bounds access and a crash. Fixes: 5ccd66e01cbe ("net: lan966x: add support for interrupts from analyzer") Signed-off-by: Dan Carpenter Signed-off-by: David S. Miller Signed-off-by: Sasha Levin --- drivers/net/ethernet/microchip/lan966x/lan966x_mac.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/net/ethernet/microchip/lan966x/lan966x_mac.c b/drivers/net/ethernet/microchip/lan966x/lan966x_mac.c index 2679111ef669..005e56ea5da1 100644 --- a/drivers/net/ethernet/microchip/lan966x/lan966x_mac.c +++ b/drivers/net/ethernet/microchip/lan966x/lan966x_mac.c @@ -346,7 +346,7 @@ static void lan966x_mac_irq_process(struct lan966x *lan966x, u32 row, lan966x_mac_process_raw_entry(&raw_entries[column], mac, &vid, &dest_idx); - if (WARN_ON(dest_idx > lan966x->num_phys_ports)) + if (WARN_ON(dest_idx >= lan966x->num_phys_ports)) continue; /* If the entry in SW is found, then there is nothing @@ -393,7 +393,7 @@ static void lan966x_mac_irq_process(struct lan966x *lan966x, u32 row, lan966x_mac_process_raw_entry(&raw_entries[column], mac, &vid, &dest_idx); - if (WARN_ON(dest_idx > lan966x->num_phys_ports)) + if (WARN_ON(dest_idx >= lan966x->num_phys_ports)) continue; mac_entry = lan966x_mac_alloc_entry(mac, vid, dest_idx); -- 2.35.1