Commit 3d7719ea authored by Florian Fainelli's avatar Florian Fainelli Committed by Zheng Zengkai
Browse files

net: dsa: bcm_sf2: Fix array overrun in bcm_sf2_num_active_ports() 

stable inclusion
from stable-5.10.68
commit a23d3576215f7447c547976817b33cb975ecec84
bugzilla: 182671 https://gitee.com/openeuler/kernel/issues/I4EWUH

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=a23d3576215f7447c547976817b33cb975ecec84



--------------------------------

commit 02319bf1 upstream.

After d12e1c46 ("net: dsa: b53: Set correct number of ports in the
DSA struct") we stopped setting dsa_switch::num_ports to DSA_MAX_PORTS,
which created an off by one error between the statically allocated
bcm_sf2_priv::port_sts array (of size DSA_MAX_PORTS). When
dsa_is_cpu_port() is used, we end-up accessing an out of bounds member
and causing a NPD.

Fix this by iterating with the appropriate port count using
ds->num_ports.

Fixes: d12e1c46 ("net: dsa: b53: Set correct number of ports in the DSA struct")
Signed-off-by: default avatarFlorian Fainelli <f.fainelli@gmail.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: default avatarChen Jun <chenjun102@huawei.com>
Acked-by: default avatarWeilong Chen <chenweilong@huawei.com>

Signed-off-by: default avatarChen Jun <chenjun102@huawei.com>
Signed-off-by: default avatarZheng Zengkai <zhengzengkai@huawei.com>
parent d1840366

drivers/net/dsa/bcm_sf2.c

+1 −1
Original line number Diff line number Diff line
@@ -38,7 +38,7 @@ static unsigned int bcm_sf2_num_active_ports(struct dsa_switch *ds) 
	struct bcm_sf2_priv *priv = bcm_sf2_to_priv(ds);

	unsigned int port, count = 0;



	for (port = 0; port < ARRAY_SIZE(priv->port_sts); port++) {

	for (port = 0; port < ds->num_ports; port++) {

		if (dsa_is_cpu_port(ds, port))

			continue;

		if (priv->port_sts[port].enabled)