git.openwrt.org Git - openwrt/staging/stintel.git/blob

   1 From: Tom Rix <trix@redhat.com>
   2 Date: Sat, 16 Jul 2022 17:46:54 -0400
   3 Subject: [PATCH] net: ethernet: mtk_eth_soc: fix off by one check of
   4  ARRAY_SIZE
   5
   6 In mtk_wed_tx_ring_setup(.., int idx, ..), idx is used as an index here
   7   struct mtk_wed_ring *ring = &dev->tx_ring[idx];
   8
   9 The bounds of idx are checked here
  10   BUG_ON(idx > ARRAY_SIZE(dev->tx_ring));
  11
  12 If idx is the size of the array, it will pass this check and overflow.
  13 So change the check to >= .
  14
  15 Fixes: 804775dfc288 ("net: ethernet: mtk_eth_soc: add support for Wireless Ethernet Dispatch (WED)")
  16 Signed-off-by: Tom Rix <trix@redhat.com>
  17 Link: https://lore.kernel.org/r/20220716214654.1540240-1-trix@redhat.com
  18 Signed-off-by: Jakub Kicinski <kuba@kernel.org>
  19 ---
  20
  21 --- a/drivers/net/ethernet/mediatek/mtk_wed.c
  22 +++ b/drivers/net/ethernet/mediatek/mtk_wed.c
  23 @@ -651,7 +651,7 @@ mtk_wed_tx_ring_setup(struct mtk_wed_dev
  24          * WDMA RX.
  25          */
  26
  27 -       BUG_ON(idx > ARRAY_SIZE(dev->tx_ring));
  28 +       BUG_ON(idx >= ARRAY_SIZE(dev->tx_ring));
  29
  30         if (mtk_wed_ring_alloc(dev, ring, MTK_WED_TX_RING_SIZE))
  31                 return -ENOMEM;