* [patch] atm: iphase: off by one in rx_pkt()
@ 2016-05-27 10:34 Dan Carpenter
2016-05-31 18:53 ` David Miller
0 siblings, 1 reply; 2+ messages in thread
From: Dan Carpenter @ 2016-05-27 10:34 UTC (permalink / raw)
To: Chas Williams; +Cc: linux-atm-general, netdev, kernel-janitors
The iadev->rx_open[] array holds "iadev->num_vc" pointers (this code
assumes that pointers are 32 bits). So the > here should be >= or else
we could end up reading a garbage pointer from one element beyond the
end of the array.
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
diff --git a/drivers/atm/iphase.c b/drivers/atm/iphase.c
index 7d00f29..f86e318 100644
--- a/drivers/atm/iphase.c
+++ b/drivers/atm/iphase.c
@@ -1128,7 +1128,7 @@ static int rx_pkt(struct atm_dev *dev)
/* make the ptr point to the corresponding buffer desc entry */
buf_desc_ptr += desc;
if (!desc || (desc > iadev->num_rx_desc) ||
- ((buf_desc_ptr->vc_index & 0xffff) > iadev->num_vc)) {
+ ((buf_desc_ptr->vc_index & 0xffff) >= iadev->num_vc)) {
free_desc(dev, desc);
IF_ERR(printk("IA: bad descriptor desc = %d \n", desc);)
return -1;
^ permalink raw reply related [flat|nested] 2+ messages in thread
* Re: [patch] atm: iphase: off by one in rx_pkt()
2016-05-27 10:34 [patch] atm: iphase: off by one in rx_pkt() Dan Carpenter
@ 2016-05-31 18:53 ` David Miller
0 siblings, 0 replies; 2+ messages in thread
From: David Miller @ 2016-05-31 18:53 UTC (permalink / raw)
To: dan.carpenter; +Cc: 3chas3, linux-atm-general, netdev, kernel-janitors
From: Dan Carpenter <dan.carpenter@oracle.com>
Date: Fri, 27 May 2016 13:34:35 +0300
> The iadev->rx_open[] array holds "iadev->num_vc" pointers (this code
> assumes that pointers are 32 bits). So the > here should be >= or else
> we could end up reading a garbage pointer from one element beyond the
> end of the array.
>
> Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Applied.
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2016-05-31 18:53 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2016-05-27 10:34 [patch] atm: iphase: off by one in rx_pkt() Dan Carpenter
2016-05-31 18:53 ` David Miller
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).