diff options
| author | Colin Ian King <colin.king@canonical.com> | 2017-01-31 16:30:02 +0000 |
|---|---|---|
| committer | David S. Miller <davem@davemloft.net> | 2017-01-31 12:25:32 -0500 |
| commit | e9904990e8e70a51574e6ec6b872f3c705ec75f0 (patch) | |
| tree | f09f227119e074b485f55a45c0cb6aa4460a4f21 /drivers/net/ethernet/sfc | |
| parent | 1bae6c99decf9137069646b593d3439171a8a8e2 (diff) | |
| download | linux-e9904990e8e70a51574e6ec6b872f3c705ec75f0.tar.gz linux-e9904990e8e70a51574e6ec6b872f3c705ec75f0.tar.xz | |
sfc: fix an off-by-one compare on an array size
encap_type should be checked to see if it is greater or equal to
the size of array map to fix an off-by-one array size check. This
fixes an array overrun read as detected by static analysis by
CoverityScan, CID#1398883 ("Out-of-bounds-read")
Fixes: 9b41080125176841e ("sfc: insert catch-all filters for encapsulated traffic")
Signed-off-by: Colin Ian King <colin.king@canonical.com>
Acked-by: Edward Cree <ecree@solarflare.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'drivers/net/ethernet/sfc')
| -rw-r--r-- | drivers/net/ethernet/sfc/ef10.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/drivers/net/ethernet/sfc/ef10.c b/drivers/net/ethernet/sfc/ef10.c index 8bec9383d754..0475f1831b92 100644 --- a/drivers/net/ethernet/sfc/ef10.c +++ b/drivers/net/ethernet/sfc/ef10.c @@ -5080,7 +5080,7 @@ static int efx_ef10_filter_insert_def(struct efx_nic *efx, /* quick bounds check (BCAST result impossible) */ BUILD_BUG_ON(EFX_EF10_BCAST != 0); - if (encap_type > ARRAY_SIZE(map) || map[encap_type] == 0) { + if (encap_type >= ARRAY_SIZE(map) || map[encap_type] == 0) { WARN_ON(1); return -EINVAL; } |