diff options
| author |   Dan Carpenter <dan.carpenter@oracle.com> | 2022-04-21 18:46:13 +0300 |
|---|---|---|
| committer |   David S. Miller <davem@davemloft.net> | 2022-04-25 11:25:37 +0100 |
| commit | 9810c58c7051ae83e7ac326fca3daa823da6b778 (patch) | |
| tree | fa203e08bc40fedd9fe7c952dea07a3dfec44d87 /drivers/net/ethernet/microchip/lan966x | |
| parent | net/smc: sync err code when tcp connection was refused (diff) | |
| download | linux-dev-9810c58c7051ae83e7ac326fca3daa823da6b778.tar.xz linux-dev-9810c58c7051ae83e7ac326fca3daa823da6b778.zip | |
net: lan966x: fix a couple off by one bugs
The lan966x->ports[] array has lan966x->num_phys_ports elements. These
are assigned in lan966x_probe(). That means the > comparison should be
changed to >=.
The first off by one check is harmless but the second one could lead to
an out of bounds access and a crash.
Fixes: 5ccd66e01cbe ("net: lan966x: add support for interrupts from analyzer")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'drivers/net/ethernet/microchip/lan966x')
| -rw-r--r-- | drivers/net/ethernet/microchip/lan966x/lan966x_mac.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/drivers/net/ethernet/microchip/lan966x/lan966x_mac.c b/drivers/net/ethernet/microchip/lan966x/lan966x_mac.c index 2679111ef669..005e56ea5da1 100644 --- a/drivers/net/ethernet/microchip/lan966x/lan966x_mac.c +++ b/drivers/net/ethernet/microchip/lan966x/lan966x_mac.c @@ -346,7 +346,7 @@ static void lan966x_mac_irq_process(struct lan966x *lan966x, u32 row, lan966x_mac_process_raw_entry(&raw_entries[column], mac, &vid, &dest_idx); - if (WARN_ON(dest_idx > lan966x->num_phys_ports)) + if (WARN_ON(dest_idx >= lan966x->num_phys_ports)) continue; /* If the entry in SW is found, then there is nothing @@ -393,7 +393,7 @@ static void lan966x_mac_irq_process(struct lan966x *lan966x, u32 row, lan966x_mac_process_raw_entry(&raw_entries[column], mac, &vid, &dest_idx); - if (WARN_ON(dest_idx > lan966x->num_phys_ports)) + if (WARN_ON(dest_idx >= lan966x->num_phys_ports)) continue; mac_entry = lan966x_mac_alloc_entry(mac, vid, dest_idx); |