diff options
| author | Alice Michael <alice.michael@intel.com> | 2018-10-27 00:33:31 +0300 |
|---|---|---|
| committer | Jeff Kirsher <jeffrey.t.kirsher@intel.com> | 2018-11-14 21:56:33 +0300 |
| commit | 843faff87af261bf55eda719a06087af0486a168 (patch) | |
| tree | 815fdca8b6ff448ebc254a8250b6c6d3da744b66 /include/linux/avf | |
| parent | c9a983058ad6ffa59b950b87e4888a43c12ebb26 (diff) | |
| download | linux-843faff87af261bf55eda719a06087af0486a168.tar.xz | |
virtchnl: Fix off by one error
When calculating the valid length for a VIRTCHNL_OP_ENABLE_CHANNELS
message, we accidentally allowed messages with one extra
virtchnl_channel_info structure on the end. This happened due
to an off by one error, because we forgot that valid_len already
accounted for one virtchnl_channel_info structure, so we need to
subtract one from the num_tc value.
Signed-off-by: Alice Michael <alice.michael@intel.com>
Tested-by: Andrew Bowers <andrewx.bowers@intel.com>
Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
Diffstat (limited to 'include/linux/avf')
| -rw-r--r-- | include/linux/avf/virtchnl.h | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/include/linux/avf/virtchnl.h b/include/linux/avf/virtchnl.h index 3130dec40b93..7605b5919c3a 100644 --- a/include/linux/avf/virtchnl.h +++ b/include/linux/avf/virtchnl.h @@ -819,8 +819,8 @@ virtchnl_vc_validate_vf_msg(struct virtchnl_version_info *ver, u32 v_opcode, if (msglen >= valid_len) { struct virtchnl_tc_info *vti = (struct virtchnl_tc_info *)msg; - valid_len += vti->num_tc * - sizeof(struct virtchnl_channel_info); + valid_len += (vti->num_tc - 1) * + sizeof(struct virtchnl_channel_info); if (vti->num_tc == 0) err_msg_format = true; } |