diff options
| author | Dan Carpenter <dan.carpenter@oracle.com> | 2019-02-13 11:23:04 +0300 |
|---|---|---|
| committer | David S. Miller <davem@davemloft.net> | 2019-02-13 22:11:53 -0800 |
| commit | 8d6ea932856c7087ce8c3d0e79494b7d5386f962 (patch) | |
| tree | cf8adf4a6803706b5ed36d7e6b7f72740c33b6e0 /drivers/net/dsa/bcm_sf2.c | |
| parent | 5bf325a53202b8728cf7013b72688c46071e212e (diff) | |
| download | lwn-8d6ea932856c7087ce8c3d0e79494b7d5386f962.tar.gz lwn-8d6ea932856c7087ce8c3d0e79494b7d5386f962.zip | |
net: dsa: bcm_sf2: potential array overflow in bcm_sf2_sw_suspend()
The value of ->num_ports comes from bcm_sf2_sw_probe() and it is less
than or equal to DSA_MAX_PORTS. The ds->ports[] array is used inside
the dsa_is_user_port() and dsa_is_cpu_port() functions. The ds->ports[]
array is allocated in dsa_switch_alloc() and it has ds->num_ports
elements so this leads to a static checker warning about a potential out
of bounds read.
Fixes: 8cfa94984c9c ("net: dsa: bcm_sf2: add suspend/resume callbacks")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Reviewed-by: Vivien Didelot <vivien.didelot@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'drivers/net/dsa/bcm_sf2.c')
| -rw-r--r-- | drivers/net/dsa/bcm_sf2.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/drivers/net/dsa/bcm_sf2.c b/drivers/net/dsa/bcm_sf2.c index 361fbde76654..17ec32b0a1cc 100644 --- a/drivers/net/dsa/bcm_sf2.c +++ b/drivers/net/dsa/bcm_sf2.c @@ -690,7 +690,7 @@ static int bcm_sf2_sw_suspend(struct dsa_switch *ds) * port, the other ones have already been disabled during * bcm_sf2_sw_setup */ - for (port = 0; port < DSA_MAX_PORTS; port++) { + for (port = 0; port < ds->num_ports; port++) { if (dsa_is_user_port(ds, port) || dsa_is_cpu_port(ds, port)) bcm_sf2_port_disable(ds, port, NULL); } |