lkml.org 
[lkml]   [2021]   [Sep]   [13]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 5.13 118/300] 6lowpan: iphc: Fix an off-by-one check of array index
    Date
    From: Colin Ian King <colin.king@canonical.com>

    [ Upstream commit 9af417610b6142e826fd1ee8ba7ff3e9a2133a5a ]

    The bounds check of id is off-by-one and the comparison should
    be >= rather >. Currently the WARN_ON_ONCE check does not stop
    the out of range indexing of &ldev->ctx.table[id] so also add
    a return path if the bounds are out of range.

    Addresses-Coverity: ("Illegal address computation").
    Fixes: 5609c185f24d ("6lowpan: iphc: add support for stateful compression")
    Signed-off-by: Colin Ian King <colin.king@canonical.com>
    Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>
    ---
    net/6lowpan/debugfs.c | 3 ++-
    1 file changed, 2 insertions(+), 1 deletion(-)

    diff --git a/net/6lowpan/debugfs.c b/net/6lowpan/debugfs.c
    index 1c140af06d52..600b9563bfc5 100644
    --- a/net/6lowpan/debugfs.c
    +++ b/net/6lowpan/debugfs.c
    @@ -170,7 +170,8 @@ static void lowpan_dev_debugfs_ctx_init(struct net_device *dev,
    struct dentry *root;
    char buf[32];

    - WARN_ON_ONCE(id > LOWPAN_IPHC_CTX_TABLE_SIZE);
    + if (WARN_ON_ONCE(id >= LOWPAN_IPHC_CTX_TABLE_SIZE))
    + return;

    sprintf(buf, "%d", id);

    --
    2.30.2


    \
     
     \ /
      Last update: 2021-09-13 16:02    [W:4.062 / U:0.084 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site