Commit f120e62e authored by Justin Chen's avatar Justin Chen Committed by David S. Miller

net: bcmasp: Sanity check is off by one

A sanity check for OOB write is off by one leading to a false positive
when the array is full.

Fixes: 9b90aca9 ("net: ethernet: bcmasp: fix possible OOB write in bcmasp_netfilt_get_all_active()")
Signed-off-by: default avatarJustin Chen <justin.chen@broadcom.com>
Reviewed-by: default avatarFlorian Fainelli <florian.fainelli@broadcom.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent 5b76d928
......@@ -535,9 +535,6 @@ int bcmasp_netfilt_get_all_active(struct bcmasp_intf *intf, u32 *rule_locs,
int j = 0, i;
for (i = 0; i < NUM_NET_FILTERS; i++) {
if (j == *rule_cnt)
return -EMSGSIZE;
if (!priv->net_filters[i].claimed ||
priv->net_filters[i].port != intf->port)
continue;
......@@ -547,6 +544,9 @@ int bcmasp_netfilt_get_all_active(struct bcmasp_intf *intf, u32 *rule_locs,
priv->net_filters[i - 1].wake_filter)
continue;
if (j == *rule_cnt)
return -EMSGSIZE;
rule_locs[j++] = priv->net_filters[i].fs.location;
}
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment