diff options
author | Florian Fainelli <f.fainelli@gmail.com> | 2020-03-30 14:38:46 -0700 |
---|---|---|
committer | David S. Miller <davem@davemloft.net> | 2020-03-30 19:55:42 -0700 |
commit | d0802dc411f469569a537283b6f3833af47aece9 (patch) | |
tree | 10a66ff3caee070eae97af4031b75095c28f5b79 /init/do_mounts_rd.c | |
parent | ed52f2c608c9451fa2bad298b2ab927416105d65 (diff) | |
download | linux-d0802dc411f469569a537283b6f3833af47aece9.tar.bz2 |
net: dsa: bcm_sf2: Fix overflow checks
Commit f949a12fd697 ("net: dsa: bcm_sf2: fix buffer overflow doing
set_rxnfc") tried to fix the some user controlled buffer overflows in
bcm_sf2_cfp_rule_set() and bcm_sf2_cfp_rule_del() but the fix was using
CFP_NUM_RULES, which while it is correct not to overflow the bitmaps, is
not representative of what the device actually supports. Correct that by
using bcm_sf2_cfp_rule_size() instead.
The latter subtracts the number of rules by 1, so change the checks from
greater than or equal to greater than accordingly.
Fixes: f949a12fd697 ("net: dsa: bcm_sf2: fix buffer overflow doing set_rxnfc")
Signed-off-by: Florian Fainelli <f.fainelli@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'init/do_mounts_rd.c')
0 files changed, 0 insertions, 0 deletions