diff options
| author | Florian Fainelli <f.fainelli@gmail.com> | 2021-09-17 00:33:35 +0300 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2021-09-22 13:28:07 +0300 |
| commit | a23d3576215f7447c547976817b33cb975ecec84 (patch) | |
| tree | 30d01d454c45be34fc8c9430cf75ff7d88fcafd6 /drivers | |
| parent | 9f2972e151dd16d3286c1407bec4e66395f30135 (diff) | |
| download | linux-a23d3576215f7447c547976817b33cb975ecec84.tar.xz | |
net: dsa: bcm_sf2: Fix array overrun in bcm_sf2_num_active_ports()
commit 02319bf15acf54004216e40ac9c171437f24be24 upstream.
After d12e1c464988 ("net: dsa: b53: Set correct number of ports in the
DSA struct") we stopped setting dsa_switch::num_ports to DSA_MAX_PORTS,
which created an off by one error between the statically allocated
bcm_sf2_priv::port_sts array (of size DSA_MAX_PORTS). When
dsa_is_cpu_port() is used, we end-up accessing an out of bounds member
and causing a NPD.
Fix this by iterating with the appropriate port count using
ds->num_ports.
Fixes: d12e1c464988 ("net: dsa: b53: Set correct number of ports in the DSA struct")
Signed-off-by: Florian Fainelli <f.fainelli@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Diffstat (limited to 'drivers')
| -rw-r--r-- | drivers/net/dsa/bcm_sf2.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/drivers/net/dsa/bcm_sf2.c b/drivers/net/dsa/bcm_sf2.c index 510324916e91..690e9d9495e7 100644 --- a/drivers/net/dsa/bcm_sf2.c +++ b/drivers/net/dsa/bcm_sf2.c @@ -38,7 +38,7 @@ static unsigned int bcm_sf2_num_active_ports(struct dsa_switch *ds) struct bcm_sf2_priv *priv = bcm_sf2_to_priv(ds); unsigned int port, count = 0; - for (port = 0; port < ARRAY_SIZE(priv->port_sts); port++) { + for (port = 0; port < ds->num_ports; port++) { if (dsa_is_cpu_port(ds, port)) continue; if (priv->port_sts[port].enabled) |