Commit 9810c58c authored by Dan Carpenter's avatar Dan Carpenter Committed by David S. Miller
Browse files

net: lan966x: fix a couple off by one bugs 



The lan966x->ports[] array has lan966x->num_phys_ports elements.  These
are assigned in lan966x_probe().  That means the > comparison should be
changed to >=.

The first off by one check is harmless but the second one could lead to
an out of bounds access and a crash.

Fixes: 5ccd66e0 ("net: lan966x: add support for interrupts from analyzer")
Signed-off-by: default avatarDan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent 4e2e65e2

drivers/net/ethernet/microchip/lan966x/lan966x_mac.c

+2 −2
Original line number Diff line number Diff line
@@ -346,7 +346,7 @@ static void lan966x_mac_irq_process(struct lan966x *lan966x, u32 row, 


			lan966x_mac_process_raw_entry(&raw_entries[column],

						      mac, &vid, &dest_idx);

			if (WARN_ON(dest_idx > lan966x->num_phys_ports))

			if (WARN_ON(dest_idx >= lan966x->num_phys_ports))

				continue;



			/* If the entry in SW is found, then there is nothing
@@ -393,7 +393,7 @@ static void lan966x_mac_irq_process(struct lan966x *lan966x, u32 row, 


		lan966x_mac_process_raw_entry(&raw_entries[column],

					      mac, &vid, &dest_idx);

		if (WARN_ON(dest_idx > lan966x->num_phys_ports))

		if (WARN_ON(dest_idx >= lan966x->num_phys_ports))

			continue;



		mac_entry = lan966x_mac_alloc_entry(mac, vid, dest_idx);