* [PATCH net-next] net: dsa: Fix off by one in dsa_loop_port_vlan_add()
@ 2021-01-19 14:53 ` Dan Carpenter
0 siblings, 0 replies; 5+ messages in thread
From: Dan Carpenter @ 2021-01-19 14:53 UTC (permalink / raw)
To: Florian Fainelli
Cc: ; Andrew Lunn, Vivien Didelot, Vladimir Oltean, David S. Miller,
Jakub Kicinski, netdev, kernel-janitors
The > comparison is intended to be >= to prevent reading beyond the
end of the ps->vlans[] array. It doesn't affect run time though because
the ps->vlans[] array has VLAN_N_VID (4096) elements and the vlan->vid
cannot be > 4094 because it is checked earlier.
Fixes: 98cd1552ea27 ("net: dsa: Mock-up driver")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
---
I'm not 100% sure where this is checked but the other code has comments
and assumptions that say that it is and Smatch says that it is. If I
had to guess, I would say that the check is in the nla policy.
[NL80211_ATTR_VLAN_ID] = NLA_POLICY_RANGE(NLA_U16, 1, VLAN_N_VID - 2),
This patch is against linux-next. I could re-write it against net if
you want. Another option would be to just delete the sanity check.
drivers/net/dsa/dsa_loop.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/net/dsa/dsa_loop.c b/drivers/net/dsa/dsa_loop.c
index 5f69216376fe..8c283f59158b 100644
--- a/drivers/net/dsa/dsa_loop.c
+++ b/drivers/net/dsa/dsa_loop.c
@@ -207,7 +207,7 @@ static int dsa_loop_port_vlan_add(struct dsa_switch *ds, int port,
struct mii_bus *bus = ps->bus;
struct dsa_loop_vlan *vl;
- if (vlan->vid > ARRAY_SIZE(ps->vlans))
+ if (vlan->vid >= ARRAY_SIZE(ps->vlans))
return -ERANGE;
/* Just do a sleeping operation to make lockdep checks effective */
--
2.29.2
^ permalink raw reply related [flat|nested] 5+ messages in thread* [PATCH net-next] net: dsa: Fix off by one in dsa_loop_port_vlan_add()
@ 2021-01-19 14:53 ` Dan Carpenter
0 siblings, 0 replies; 5+ messages in thread
From: Dan Carpenter @ 2021-01-19 14:53 UTC (permalink / raw)
To: Florian Fainelli
Cc: ; Andrew Lunn, Vivien Didelot, Vladimir Oltean, David S. Miller,
Jakub Kicinski, netdev, kernel-janitors
The > comparison is intended to be >= to prevent reading beyond the
end of the ps->vlans[] array. It doesn't affect run time though because
the ps->vlans[] array has VLAN_N_VID (4096) elements and the vlan->vid
cannot be > 4094 because it is checked earlier.
Fixes: 98cd1552ea27 ("net: dsa: Mock-up driver")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
---
I'm not 100% sure where this is checked but the other code has comments
and assumptions that say that it is and Smatch says that it is. If I
had to guess, I would say that the check is in the nla policy.
[NL80211_ATTR_VLAN_ID] = NLA_POLICY_RANGE(NLA_U16, 1, VLAN_N_VID - 2),
This patch is against linux-next. I could re-write it against net if
you want. Another option would be to just delete the sanity check.
drivers/net/dsa/dsa_loop.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/net/dsa/dsa_loop.c b/drivers/net/dsa/dsa_loop.c
index 5f69216376fe..8c283f59158b 100644
--- a/drivers/net/dsa/dsa_loop.c
+++ b/drivers/net/dsa/dsa_loop.c
@@ -207,7 +207,7 @@ static int dsa_loop_port_vlan_add(struct dsa_switch *ds, int port,
struct mii_bus *bus = ps->bus;
struct dsa_loop_vlan *vl;
- if (vlan->vid > ARRAY_SIZE(ps->vlans))
+ if (vlan->vid >= ARRAY_SIZE(ps->vlans))
return -ERANGE;
/* Just do a sleeping operation to make lockdep checks effective */
--
2.29.2
^ permalink raw reply related [flat|nested] 5+ messages in thread* Re: [PATCH net-next] net: dsa: Fix off by one in dsa_loop_port_vlan_add()
2021-01-19 14:53 ` Dan Carpenter
@ 2021-01-19 17:47 ` Florian Fainelli
-1 siblings, 0 replies; 5+ messages in thread
From: Florian Fainelli @ 2021-01-19 17:47 UTC (permalink / raw)
To: Dan Carpenter
Cc: , Andrew Lunn, Vivien Didelot, Vladimir Oltean, David S. Miller,
Jakub Kicinski, netdev, kernel-janitors
On 1/19/2021 6:53 AM, Dan Carpenter wrote:
> The > comparison is intended to be >= to prevent reading beyond the
> end of the ps->vlans[] array. It doesn't affect run time though because
> the ps->vlans[] array has VLAN_N_VID (4096) elements and the vlan->vid
> cannot be > 4094 because it is checked earlier.
>
> Fixes: 98cd1552ea27 ("net: dsa: Mock-up driver")
> Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Acked-by: Florian Fainelli <f.fainelli@gmail.com>
--
Florian
^ permalink raw reply [flat|nested] 5+ messages in thread* Re: [PATCH net-next] net: dsa: Fix off by one in dsa_loop_port_vlan_add()
@ 2021-01-19 17:47 ` Florian Fainelli
0 siblings, 0 replies; 5+ messages in thread
From: Florian Fainelli @ 2021-01-19 17:47 UTC (permalink / raw)
To: Dan Carpenter
Cc: , Andrew Lunn, Vivien Didelot, Vladimir Oltean, David S. Miller,
Jakub Kicinski, netdev, kernel-janitors
On 1/19/2021 6:53 AM, Dan Carpenter wrote:
> The > comparison is intended to be >= to prevent reading beyond the
> end of the ps->vlans[] array. It doesn't affect run time though because
> the ps->vlans[] array has VLAN_N_VID (4096) elements and the vlan->vid
> cannot be > 4094 because it is checked earlier.
>
> Fixes: 98cd1552ea27 ("net: dsa: Mock-up driver")
> Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Acked-by: Florian Fainelli <f.fainelli@gmail.com>
--
Florian
^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: [PATCH net-next] net: dsa: Fix off by one in dsa_loop_port_vlan_add()
2021-01-19 14:53 ` Dan Carpenter
(?)
(?)
@ 2021-01-21 5:00 ` patchwork-bot+netdevbpf
-1 siblings, 0 replies; 5+ messages in thread
From: patchwork-bot+netdevbpf @ 2021-01-21 5:00 UTC (permalink / raw)
To: Dan Carpenter
Cc: f.fainelli, andrew, vivien.didelot, olteanv, davem, kuba, netdev,
kernel-janitors
Hello:
This patch was applied to netdev/net-next.git (refs/heads/master):
On Tue, 19 Jan 2021 17:53:35 +0300 you wrote:
> The > comparison is intended to be >= to prevent reading beyond the
> end of the ps->vlans[] array. It doesn't affect run time though because
> the ps->vlans[] array has VLAN_N_VID (4096) elements and the vlan->vid
> cannot be > 4094 because it is checked earlier.
>
> Fixes: 98cd1552ea27 ("net: dsa: Mock-up driver")
> Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
>
> [...]
Here is the summary with links:
- [net-next] net: dsa: Fix off by one in dsa_loop_port_vlan_add()
https://git.kernel.org/netdev/net-next/c/646188c9550f
You are awesome, thank you!
--
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html
^ permalink raw reply [flat|nested] 5+ messages in thread
end of thread, other threads:[~2021-01-21 5:25 UTC | newest]
Thread overview: 5+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2021-01-19 14:53 [PATCH net-next] net: dsa: Fix off by one in dsa_loop_port_vlan_add() Dan Carpenter
2021-01-19 14:53 ` Dan Carpenter
2021-01-19 17:47 ` Florian Fainelli
2021-01-19 17:47 ` Florian Fainelli
2021-01-21 5:00 ` patchwork-bot+netdevbpf
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.