summaryrefslogtreecommitdiff
path: root/drivers
diff options
context:
space:
mode:
authorColin Ian King <colin.king@canonical.com>2020-03-12 15:04:30 +0000
committerDavid S. Miller <davem@davemloft.net>2020-03-12 15:50:18 -0700
commitc0368595c1639947839c0db8294ee96aca0b3b86 (patch)
tree035722a01655c9b3e49a464418777ec2a9da7665 /drivers
parent9d0e0cd9a529ba68b2acda68b5075d4a5ea7118a (diff)
net: systemport: fix index check to avoid an array out of bounds access
Currently the bounds check on index is off by one and can lead to an out of bounds access on array priv->filters_loc when index is RXCHK_BRCM_TAG_MAX. Fixes: bb9051a2b230 ("net: systemport: Add support for WAKE_FILTER") Signed-off-by: Colin Ian King <colin.king@canonical.com> Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'drivers')
-rw-r--r--drivers/net/ethernet/broadcom/bcmsysport.c2
1 files changed, 1 insertions, 1 deletions
diff --git a/drivers/net/ethernet/broadcom/bcmsysport.c b/drivers/net/ethernet/broadcom/bcmsysport.c
index e0611cba87f9..15b31cddc054 100644
--- a/drivers/net/ethernet/broadcom/bcmsysport.c
+++ b/drivers/net/ethernet/broadcom/bcmsysport.c
@@ -2135,7 +2135,7 @@ static int bcm_sysport_rule_set(struct bcm_sysport_priv *priv,
return -ENOSPC;
index = find_first_zero_bit(priv->filters, RXCHK_BRCM_TAG_MAX);
- if (index > RXCHK_BRCM_TAG_MAX)
+ if (index >= RXCHK_BRCM_TAG_MAX)
return -ENOSPC;
/* Location is the classification ID, and index is the position