mirror of
https://github.com/openwrt/openwrt.git
synced 2024-12-25 00:11:13 +00:00
32 lines
1.0 KiB
Diff
32 lines
1.0 KiB
Diff
|
From: Tom Rix <trix@redhat.com>
|
||
|
|
Date: Sat, 16 Jul 2022 17:46:54 -0400
|
||
|
|
Subject: [PATCH] net: ethernet: mtk_eth_soc: fix off by one check of
|
||
|
|
ARRAY_SIZE
|
||
|
|
|
||
|
|
In mtk_wed_tx_ring_setup(.., int idx, ..), idx is used as an index here
|
||
|
|
struct mtk_wed_ring *ring = &dev->tx_ring[idx];
|
||
|
|
|
||
|
|
The bounds of idx are checked here
|
||
|
|
BUG_ON(idx > ARRAY_SIZE(dev->tx_ring));
|
||
|
|
|
||
|
|
If idx is the size of the array, it will pass this check and overflow.
|
||
|
|
So change the check to >= .
|
||
|
|
|
||
|
|
Fixes: 804775dfc288 ("net: ethernet: mtk_eth_soc: add support for Wireless Ethernet Dispatch (WED)")
|
||
|
|
Signed-off-by: Tom Rix <trix@redhat.com>
|
||
|
|
Link: https://lore.kernel.org/r/20220716214654.1540240-1-trix@redhat.com
|
||
|
|
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
|
||
|
|
---
|
||
|
|
|
||
|
|
--- a/drivers/net/ethernet/mediatek/mtk_wed.c
|
||
|
|
+++ b/drivers/net/ethernet/mediatek/mtk_wed.c
|
||
|
|
@@ -651,7 +651,7 @@ mtk_wed_tx_ring_setup(struct mtk_wed_dev
|
||
|
|
* WDMA RX.
|
||
|
|
*/
|
||
|
|
|
||
|
|
- BUG_ON(idx > ARRAY_SIZE(dev->tx_ring));
|
||
|
|
+ BUG_ON(idx >= ARRAY_SIZE(dev->tx_ring));
|
||
|
|
|
||
|
|
if (mtk_wed_ring_alloc(dev, ring, MTK_WED_TX_RING_SIZE))
|
||
|
|
return -ENOMEM;
|