From c02462d8a3e96d99967fb26fca7375d449328ce6 Mon Sep 17 00:00:00 2001 From: Colin Ian King Date: Sat, 30 Jun 2018 21:39:24 +0100 Subject: netdevsim: fix sa_idx out of bounds check Currently if sa_idx is equal to NSIM_IPSEC_MAX_SA_COUNT then an out-of-bounds read on ipsec->sa will occur. Fix the incorrect bounds check by using >= rather than >. Detected by CoverityScan, CID#1470226 ("Out-of-bounds-read") Fixes: 7699353da875 ("netdevsim: add ipsec offload testing") Signed-off-by: Colin Ian King Acked-by: Shannon Nelson Signed-off-by: David S. Miller --- drivers/net/netdevsim/ipsec.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'drivers/net') diff --git a/drivers/net/netdevsim/ipsec.c b/drivers/net/netdevsim/ipsec.c index ceff544510b9..2dcf6cc269d0 100644 --- a/drivers/net/netdevsim/ipsec.c +++ b/drivers/net/netdevsim/ipsec.c @@ -249,7 +249,7 @@ bool nsim_ipsec_tx(struct netdevsim *ns, struct sk_buff *skb) } sa_idx = xs->xso.offload_handle & ~NSIM_IPSEC_VALID; - if (unlikely(sa_idx > NSIM_IPSEC_MAX_SA_COUNT)) { + if (unlikely(sa_idx >= NSIM_IPSEC_MAX_SA_COUNT)) { netdev_err(ns->netdev, "bad sa_idx=%d max=%d\n", sa_idx, NSIM_IPSEC_MAX_SA_COUNT); return false; -- cgit v1.2.3-59-g8ed1b