Commit c0368595 authored Mar 12, 2020 by Colin Ian King Committed by David S. Miller Mar 12, 2020

net: systemport: fix index check to avoid an array out of bounds access



Currently the bounds check on index is off by one and can lead to
an out of bounds access on array priv->filters_loc when index is
RXCHK_BRCM_TAG_MAX.

Fixes: bb9051a2 ("net: systemport: Add support for WAKE_FILTER")
Signed-off-by: Colin Ian King <colin.king@canonical.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

parent 9d0e0cd9

drivers/net/ethernet/broadcom/bcmsysport.c

+1 −1

Original line number	Diff line number	Diff line
		@@ -2135,7 +2135,7 @@ static int bcm_sysport_rule_set(struct bcm_sysport_priv *priv,
		return -ENOSPC;

		index = find_first_zero_bit(priv->filters, RXCHK_BRCM_TAG_MAX);
		if (index > RXCHK_BRCM_TAG_MAX)
		if (index >= RXCHK_BRCM_TAG_MAX)
		return -ENOSPC;

		/* Location is the classification ID, and index is the position

Admin message