提交 388f3adb 编写于 作者: D Dan Carpenter 提交者: Greg Kroah-Hartman

net: dsa: bcm_sf2: potential array overflow in bcm_sf2_sw_suspend()

[ Upstream commit 8d6ea932856c7087ce8c3d0e79494b7d5386f962 ]

The value of ->num_ports comes from bcm_sf2_sw_probe() and it is less
than or equal to DSA_MAX_PORTS.  The ds->ports[] array is used inside
the dsa_is_user_port() and dsa_is_cpu_port() functions.  The ds->ports[]
array is allocated in dsa_switch_alloc() and it has ds->num_ports
elements so this leads to a static checker warning about a potential out
of bounds read.

Fixes: 8cfa9498 ("net: dsa: bcm_sf2: add suspend/resume callbacks")
Signed-off-by: NDan Carpenter <dan.carpenter@oracle.com>
Reviewed-by: NVivien Didelot <vivien.didelot@gmail.com>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>
Signed-off-by: NSasha Levin <sashal@kernel.org>
上级 8ab49fd5
...@@ -692,7 +692,7 @@ static int bcm_sf2_sw_suspend(struct dsa_switch *ds) ...@@ -692,7 +692,7 @@ static int bcm_sf2_sw_suspend(struct dsa_switch *ds)
* port, the other ones have already been disabled during * port, the other ones have already been disabled during
* bcm_sf2_sw_setup * bcm_sf2_sw_setup
*/ */
for (port = 0; port < DSA_MAX_PORTS; port++) { for (port = 0; port < ds->num_ports; port++) {
if (dsa_is_user_port(ds, port) || dsa_is_cpu_port(ds, port)) if (dsa_is_user_port(ds, port) || dsa_is_cpu_port(ds, port))
bcm_sf2_port_disable(ds, port, NULL); bcm_sf2_port_disable(ds, port, NULL);
} }
......
Markdown is supported
0% .
You are about to add 0 people to the discussion. Proceed with caution.
先完成此消息的编辑!
想要评论请 注册