27c9d80f51
Some checks failed
Build Kernel / Build all affected Kernels (push) Has been cancelled
Build all core packages / Build all core packages for selected target (push) Has been cancelled
Build and Push prebuilt tools container / Build and Push all prebuilt containers (push) Has been cancelled
Build Toolchains / Build Toolchains for each target (push) Has been cancelled
Build host tools / Build host tools for linux and macos based systems (push) Has been cancelled
Coverity scan build / Coverity x86/64 build (push) Has been cancelled
32 lines
1.0 KiB
Diff
32 lines
1.0 KiB
Diff
From: Tom Rix <trix@redhat.com>
|
|
Date: Sat, 16 Jul 2022 17:46:54 -0400
|
|
Subject: [PATCH] net: ethernet: mtk_eth_soc: fix off by one check of
|
|
ARRAY_SIZE
|
|
|
|
In mtk_wed_tx_ring_setup(.., int idx, ..), idx is used as an index here
|
|
struct mtk_wed_ring *ring = &dev->tx_ring[idx];
|
|
|
|
The bounds of idx are checked here
|
|
BUG_ON(idx > ARRAY_SIZE(dev->tx_ring));
|
|
|
|
If idx is the size of the array, it will pass this check and overflow.
|
|
So change the check to >= .
|
|
|
|
Fixes: 804775dfc288 ("net: ethernet: mtk_eth_soc: add support for Wireless Ethernet Dispatch (WED)")
|
|
Signed-off-by: Tom Rix <trix@redhat.com>
|
|
Link: https://lore.kernel.org/r/20220716214654.1540240-1-trix@redhat.com
|
|
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
|
|
---
|
|
|
|
--- a/drivers/net/ethernet/mediatek/mtk_wed.c
|
|
+++ b/drivers/net/ethernet/mediatek/mtk_wed.c
|
|
@@ -651,7 +651,7 @@ mtk_wed_tx_ring_setup(struct mtk_wed_dev
|
|
* WDMA RX.
|
|
*/
|
|
|
|
- BUG_ON(idx > ARRAY_SIZE(dev->tx_ring));
|
|
+ BUG_ON(idx >= ARRAY_SIZE(dev->tx_ring));
|
|
|
|
if (mtk_wed_ring_alloc(dev, ring, MTK_WED_TX_RING_SIZE))
|
|
return -ENOMEM;
|