From: Dan Carpenter Date: Tue, 19 Jan 2021 14:53:35 +0000 (+0300) Subject: net: dsa: Fix off by one in dsa_loop_port_vlan_add() X-Git-Url: http://git.maquefel.me/?a=commitdiff_plain;h=646188c9550f74454dfc172a347dad693e5bfc84;p=linux.git net: dsa: Fix off by one in dsa_loop_port_vlan_add() The > comparison is intended to be >= to prevent reading beyond the end of the ps->vlans[] array. It doesn't affect run time though because the ps->vlans[] array has VLAN_N_VID (4096) elements and the vlan->vid cannot be > 4094 because it is checked earlier. Signed-off-by: Dan Carpenter Acked-by: Florian Fainelli Link: https://lore.kernel.org/r/YAbyb5kBJQlpYCs2@mwanda Signed-off-by: Jakub Kicinski --- diff --git a/drivers/net/dsa/dsa_loop.c b/drivers/net/dsa/dsa_loop.c index 5f69216376fe2..8c283f59158b0 100644 --- a/drivers/net/dsa/dsa_loop.c +++ b/drivers/net/dsa/dsa_loop.c @@ -207,7 +207,7 @@ static int dsa_loop_port_vlan_add(struct dsa_switch *ds, int port, struct mii_bus *bus = ps->bus; struct dsa_loop_vlan *vl; - if (vlan->vid > ARRAY_SIZE(ps->vlans)) + if (vlan->vid >= ARRAY_SIZE(ps->vlans)) return -ERANGE; /* Just do a sleeping operation to make lockdep checks effective */