Commit fd8e899c authored by Rustam Subkhankulov's avatar Rustam Subkhankulov Committed by Jakub Kicinski
Browse files

net: dsa: sja1105: fix buffer overflow in sja1105_setup_devlink_regions() 



If an error occurs in dsa_devlink_region_create(), then 'priv->regions'
array will be accessed by negative index '-1'.

Found by Linux Verification Center (linuxtesting.org) with SVACE.

Signed-off-by: default avatarRustam Subkhankulov <subkhankulov@ispras.ru>
Fixes: bf425b82 ("net: dsa: sja1105: expose static config as devlink region")
Link: https://lore.kernel.org/r/20220817003845.389644-1-subkhankulov@ispras.ru


Signed-off-by: default avatarJakub Kicinski <kuba@kernel.org>
parent bec13ba9

drivers/net/dsa/sja1105/sja1105_devlink.c

+1 −1
Original line number Diff line number Diff line
@@ -93,7 +93,7 @@ static int sja1105_setup_devlink_regions(struct dsa_switch *ds) 


		region = dsa_devlink_region_create(ds, ops, 1, size);

		if (IS_ERR(region)) {

			while (i-- >= 0)

			while (--i >= 0)

				dsa_devlink_region_destroy(priv->regions[i]);

			return PTR_ERR(region);

		}