diff options
| author |   Rustam Subkhankulov <subkhankulov@ispras.ru> | 2022-08-17 03:38:45 +0300 |
|---|---|---|
| committer |   Jakub Kicinski <kuba@kernel.org> | 2022-08-17 21:58:15 -0700 |
| commit | fd8e899cdb5ecaf8e8ee73854a99e10807eef1de (patch) | |
| tree | 0227d389b7ad0c94a359fef732815bfca0fdf693 /drivers/net/dsa/sja1105 | |
| parent | Merge git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf (diff) | |
| download | linux-dev-fd8e899cdb5ecaf8e8ee73854a99e10807eef1de.tar.xz linux-dev-fd8e899cdb5ecaf8e8ee73854a99e10807eef1de.zip | |
net: dsa: sja1105: fix buffer overflow in sja1105_setup_devlink_regions()
If an error occurs in dsa_devlink_region_create(), then 'priv->regions'
array will be accessed by negative index '-1'.
Found by Linux Verification Center (linuxtesting.org) with SVACE.
Signed-off-by: Rustam Subkhankulov <subkhankulov@ispras.ru>
Fixes: bf425b82059e ("net: dsa: sja1105: expose static config as devlink region")
Link: https://lore.kernel.org/r/20220817003845.389644-1-subkhankulov@ispras.ru
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Diffstat (limited to 'drivers/net/dsa/sja1105')
| -rw-r--r-- | drivers/net/dsa/sja1105/sja1105_devlink.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/drivers/net/dsa/sja1105/sja1105_devlink.c b/drivers/net/dsa/sja1105/sja1105_devlink.c index 0569ff066634..10c6fea1227f 100644 --- a/drivers/net/dsa/sja1105/sja1105_devlink.c +++ b/drivers/net/dsa/sja1105/sja1105_devlink.c @@ -93,7 +93,7 @@ static int sja1105_setup_devlink_regions(struct dsa_switch *ds) region = dsa_devlink_region_create(ds, ops, 1, size); if (IS_ERR(region)) { - while (i-- >= 0) + while (--i >= 0) dsa_devlink_region_destroy(priv->regions[i]); return PTR_ERR(region); } |