Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
Date:   Fri, 6 May 2022 17:53:52 +0300
From:   Dan Carpenter <dan.carpenter@oracle.com>
To:     Dipen Patel <dipenp@nvidia.com>
Cc:     Thierry Reding <treding@nvidia.com>, linux-kernel@vger.kernel.org,
        kernel-janitors@vger.kernel.org
Subject: [PATCH 1/2] hte: fix off by one in hte_push_ts_ns()
Message-ID: <YnU2gHe+QZOAuNyV@kili>
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
MIME-Version: 1.0
X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1
X-MS-Exchange-AntiSpam-MessageData-0: =?us-ascii?Q?iJQm6ZxWq9AOfCh/x707TV1vP1GcZLbShEnqaUEfc/aIp9Lt2wWXw2fCAsNS?=
 =?us-ascii?Q?UtmYQcMVSKfKBko0eg/6lVQsaUevV0jpSGQxyH7i8oSOcvoOCQ4zOe14bOww?=
 =?us-ascii?Q?kPzaN7RP3qiku/BGHR31W4DkLbuOkjDH7l3BB3sW4R2xF8boDUFwcJ2u4Vzx?=
 =?us-ascii?Q?HFy5VQxkhIvFUMG5189JUGtBgiXlAwg1HfAD9kM3Hj7DxTKIH/dQJTFWllW2?=
 =?us-ascii?Q?VouVfZanvwBq9NzSt7execdfMLI1iiYbLdY44AQnOCSsSQh/2Rk7QXjAfNtW?=
 =?us-ascii?Q?EsrPOweKqXvouSIYoZ0taPKwLcoigr8r6GqcWs68bzXJQrTJzm0v5jLNSEgs?=
 =?us-ascii?Q?P+p8r5DdTr/Q28qGweTTxWUYhdT9Jbi2yYlq1uQdHq8caw0hzyWHHceTaVUw?=
 =?us-ascii?Q?x64y2aDk06ArTTBKEi2n7D3mYgEv/7DBRSSkixBLin8jTPAJAa1myg9mA+qF?=
 =?us-ascii?Q?1+mPk+klLYa0xL8RYBpyF1RboFGRsqHZhSnQgvcCNRFlFlpCzGvqdwURMre4?=
 =?us-ascii?Q?QSHgCjj9LXjKcowoNSPfzv8PcU461elOCvK7NZEfaiGY0JMTLK2+zp6/IOhn?=
 =?us-ascii?Q?Hp7polivzcym7XybU0A8GXM0kmC4+BcMLzwlMQWG/X2p49R1LdNOdGr4t2hC?=
 =?us-ascii?Q?VXFEyEE9/KgwpKjjBfYlH6xpxeXK5IjRKmOKI9okPQUg5x1L5kkZNNKEv4wi?=
 =?us-ascii?Q?HsK7u2oKmfQ0zRJHlLczvdDPIREi89OmVmuBUNjAsqVlwJS21Gc2vju0Oz13?=
 =?us-ascii?Q?wBw5qVWEpalYypaksz1muAMYQHJ86SiIL7Io14E1Cm8rNBYdHIQ7PSqP59w7?=
 =?us-ascii?Q?q2upkHyiThdqsXr5DNg55gWbmTM+1nUgC4un2Mw2fr6JYhr37cJYxORPAKtX?=
 =?us-ascii?Q?E4tHx5fvOoUzLzQPxvKWaaTyclWt4cTA9i1FXMsfqN7r7cA895Ua3gmgBpn0?=
 =?us-ascii?Q?gArYvwxks+vRITDiQpIVUoNewr5rZ8g9Aua4Wf9Wz1hOz2wDlD0XtFReI2hS?=
 =?us-ascii?Q?m6P4Z7OM6EbUeKjWx3Gmalqs5lhsdgFGgOFGMTotbwtshRqJIG1gBYfERPP7?=
 =?us-ascii?Q?x3deF/qkLeL7dPxeQH1/fza4YpLhc2t9JiUixfVTCIWGuaow6jQJB+Wy9sZx?=
 =?us-ascii?Q?6bYLUmifa6ZLuNOKxY0VuB79ZB0tfK+PVcmqdRKE/aUfXNdV4BwtuJBPH6+C?=
 =?us-ascii?Q?MWU70nJjTl87WJBgnESlvFKCOCTff0m52RI5zPrcv6V3EdDeoXrAgtBHQnG2?=
 =?us-ascii?Q?0I+1XEW0sP+t0RZ2Q7dz7eE3KjYKeQK8u8D1HN4gcfZL5QlV4qcoZovT2rM9?=
 =?us-ascii?Q?gahvzo0cxMuTMKWkOf3Qj2Sio49EMhrl3JlaPmOelRI+7xwVXWmiBAqgh8N8?=
 =?us-ascii?Q?aY4a0FA+jBi9oS88NEwvxG1PDFMR0syy/fMJ88Sw+IiBiLpCEyj5dPAakEHO?=
 =?us-ascii?Q?4d33g4KHADUFOKzYCGB+H2DgKddbdLWssJpVK75ls7BtUSpjFJTx1lhR2czp?=
 =?us-ascii?Q?KYvPpxCgUMHlrcdXL0A0QacEx7yzBOGYO3ZjnjcGH32fVCcdIWfHV3x1NmGg?=
 =?us-ascii?Q?QK/O1jMEnakLwUXjgVBxIoE7L5/lBTpvNENcVEU0rLuhWCuSHh06ZH2+2w6Y?=
 =?us-ascii?Q?nhzPoqKJyTkdnoqQEbIJyfmFrmExZU9/V8M1Y8/CrpfN8dbXlErVTatyVXyM?=
 =?us-ascii?Q?/MpjDNIEGZYLVF3WMQkAtqr9rKF7oJC8BVDAakM43bRBkeWt9tWnd+/3CoeS?=
 =?us-ascii?Q?SG5CXqGC8nxV8PQXbuYRBYOv6p+VVjw=3D?=
X-OriginatorOrg: oracle.com
X-MS-Exchange-CrossTenant-Network-Message-Id: 83265724-abd0-4baf-3e3c-08da2f704264
X-MS-Exchange-CrossTenant-AuthSource: MWHPR1001MB2365.namprd10.prod.outlook.com
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 06 May 2022 14:54:02.4929
 (UTC)
X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted
X-MS-Exchange-CrossTenant-Id: 4e2c6054-71cb-48f1-bd6c-3a9705aca71b
X-MS-Exchange-CrossTenant-MailboxType: HOSTED
X-MS-Exchange-CrossTenant-UserPrincipalName: K/u+U/FDOzUzCVw9XFysqZXGa+fBCtpcgt8aTl+DsXfgi64foBKtVG1WAjn+bABtUruGZ8ncxhpyFg6kOPwTzqdW6evu4Oj0MLKGkiBtkWo=
X-MS-Exchange-Transport-CrossTenantHeadersStamped: MWHPR10MB1821
X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10434:6.0.486,18.0.858
 definitions=2022-05-06_04:2022-05-05,2022-05-06 signatures=0
X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 adultscore=0 bulkscore=0 malwarescore=0
 spamscore=0 mlxlogscore=999 mlxscore=0 suspectscore=0 phishscore=0
 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2202240000
 definitions=main-2205060080
X-Proofpoint-GUID: 3VK4PClDEbyVZsqyvDCxRo37BT3kfOi-
X-Proofpoint-ORIG-GUID: 3VK4PClDEbyVZsqyvDCxRo37BT3kfOi-
X-Spam-Status: No, score=-2.8 required=5.0 tests=BAYES_00,DKIM_SIGNED,
        DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,RCVD_IN_DNSWL_LOW,SPF_HELO_NONE,
        SPF_NONE,T_SCC_BODY_TEXT_LINE autolearn=ham autolearn_force=no
        version=3.4.6
X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on
        lindbergh.monkeyblade.net
Precedence: bulk
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: linux-kernel@vger.kernel.org

The &chip->gdev->ei[] array has chip->nlines elements so this >
comparison needs to be >= to prevent an out of bounds access. The
gdev->ei[] array is allocated in hte_register_chip().

Fixes: 31ab09b42188 ("drivers: Add hardware timestamp engine (HTE) subsystem")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
---
 drivers/hte/hte.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/hte/hte.c b/drivers/hte/hte.c
index 891b98ad609e..a14c5bf290ff 100644
--- a/drivers/hte/hte.c
+++ b/drivers/hte/hte.c
@@ -811,7 +811,7 @@ int hte_push_ts_ns(const struct hte_chip *chip, u32 xlated_id,
 	if (!chip || !data || !chip->gdev)
 		return -EINVAL;
 
-	if (xlated_id > chip->nlines)
+	if (xlated_id >= chip->nlines)
 		return -EINVAL;
 
 	ei = &chip->gdev->ei[xlated_id];
-- 
2.35.1