diff options
| author | Justin Chen <justin.chen@broadcom.com> | 2024-02-15 10:27:32 -0800 |
|---|---|---|
| committer | David S. Miller <davem@davemloft.net> | 2024-02-18 11:32:10 +0000 |
| commit | f120e62e37f0af4c4cbe08e5a88ea60a6a17c858 (patch) | |
| tree | 4e1e568c4d36f679c890547f97c56bdc07595e91 /drivers/net/ethernet | |
| parent | 5b76d928f8b779a1b19c5842e7cabee4cbb610c3 (diff) | |
net: bcmasp: Sanity check is off by one
A sanity check for OOB write is off by one leading to a false positive
when the array is full.
Fixes: 9b90aca97f6d ("net: ethernet: bcmasp: fix possible OOB write in bcmasp_netfilt_get_all_active()")
Signed-off-by: Justin Chen <justin.chen@broadcom.com>
Reviewed-by: Florian Fainelli <florian.fainelli@broadcom.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'drivers/net/ethernet')
| -rw-r--r-- | drivers/net/ethernet/broadcom/asp2/bcmasp.c | 6 |
1 files changed, 3 insertions, 3 deletions
diff --git a/drivers/net/ethernet/broadcom/asp2/bcmasp.c b/drivers/net/ethernet/broadcom/asp2/bcmasp.c index 29b04a274d07..80245c65cc90 100644 --- a/drivers/net/ethernet/broadcom/asp2/bcmasp.c +++ b/drivers/net/ethernet/broadcom/asp2/bcmasp.c @@ -535,9 +535,6 @@ int bcmasp_netfilt_get_all_active(struct bcmasp_intf *intf, u32 *rule_locs, int j = 0, i; for (i = 0; i < NUM_NET_FILTERS; i++) { - if (j == *rule_cnt) - return -EMSGSIZE; - if (!priv->net_filters[i].claimed || priv->net_filters[i].port != intf->port) continue; @@ -547,6 +544,9 @@ int bcmasp_netfilt_get_all_active(struct bcmasp_intf *intf, u32 *rule_locs, priv->net_filters[i - 1].wake_filter) continue; + if (j == *rule_cnt) + return -EMSGSIZE; + rule_locs[j++] = priv->net_filters[i].fs.location; } |