netdev.vger.kernel.org archive mirror
 help / color / mirror / Atom feed
* [PATCH net-next] net: sched: sch: Fix off by one in htb_activate_prios()
@ 2023-02-06 13:18 Dan Carpenter
  2023-02-06 14:15 ` Simon Horman
                   ` (3 more replies)
  0 siblings, 4 replies; 6+ messages in thread
From: Dan Carpenter @ 2023-02-06 13:18 UTC (permalink / raw)
  To: Jamal Hadi Salim, Kees Cook
  Cc: Cong Wang, Jiri Pirko, David S. Miller, Eric Dumazet,
	Jakub Kicinski, Paolo Abeni, Simon Horman, netdev,
	kernel-janitors

The > needs be >= to prevent an out of bounds access.

Fixes: de5ca4c3852f ("net: sched: sch: Bounds check priority")
Signed-off-by: Dan Carpenter <error27@gmail.com>
---
 net/sched/sch_htb.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/net/sched/sch_htb.c b/net/sched/sch_htb.c
index cc28e41fb745..92f2975b6a82 100644
--- a/net/sched/sch_htb.c
+++ b/net/sched/sch_htb.c
@@ -433,7 +433,7 @@ static void htb_activate_prios(struct htb_sched *q, struct htb_class *cl)
 		while (m) {
 			unsigned int prio = ffz(~m);
 
-			if (WARN_ON_ONCE(prio > ARRAY_SIZE(p->inner.clprio)))
+			if (WARN_ON_ONCE(prio >= ARRAY_SIZE(p->inner.clprio)))
 				break;
 			m &= ~(1 << prio);
 
-- 
2.35.1


^ permalink raw reply related	[flat|nested] 6+ messages in thread

end of thread, other threads:[~2023-02-08  7:50 UTC | newest]

Thread overview: 6+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2023-02-06 13:18 [PATCH net-next] net: sched: sch: Fix off by one in htb_activate_prios() Dan Carpenter
2023-02-06 14:15 ` Simon Horman
2023-02-06 18:39 ` Kees Cook
2023-02-08  4:16 ` Jakub Kicinski
2023-02-08  6:18   ` Dan Carpenter
2023-02-08  7:50 ` patchwork-bot+netdevbpf

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).