From mboxrd@z Thu Jan 1 00:00:00 1970 From: Shannon Nelson Subject: Re: [PATCH net] ixgbe: Off by one in ixgbe_ipsec_tx() Date: Mon, 9 Jul 2018 08:53:23 -0700 Message-ID: <792c0d59-5d12-7962-90a6-b17881aaefd9@oracle.com> References: <20180704095337.nqiczkkd5r6k755v@kili.mountain> Mime-Version: 1.0 Content-Type: text/plain; charset=utf-8; format=flowed Content-Transfer-Encoding: 7bit Cc: "David S. Miller" , intel-wired-lan@lists.osuosl.org, netdev@vger.kernel.org, kernel-janitors@vger.kernel.org To: Dan Carpenter , Jeff Kirsher Return-path: Received: from aserp2120.oracle.com ([141.146.126.78]:59262 "EHLO aserp2120.oracle.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S933601AbeGIPxb (ORCPT ); Mon, 9 Jul 2018 11:53:31 -0400 In-Reply-To: <20180704095337.nqiczkkd5r6k755v@kili.mountain> Content-Language: en-US Sender: netdev-owner@vger.kernel.org List-ID: On 7/4/2018 2:53 AM, Dan Carpenter wrote: > The ipsec->tx_tbl[] has IXGBE_IPSEC_MAX_SA_COUNT elements so the > needs > to be changed to >= so we don't read one element beyond the end of the > array. > > Fixes: 592594704761 ("ixgbe: process the Tx ipsec offload") > Signed-off-by: Dan Carpenter Acked-by: Shannon Nelson > > diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_ipsec.c b/drivers/net/ethernet/intel/ixgbe/ixgbe_ipsec.c > index c116f459945d..da4322e4daed 100644 > --- a/drivers/net/ethernet/intel/ixgbe/ixgbe_ipsec.c > +++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_ipsec.c > @@ -839,7 +839,7 @@ int ixgbe_ipsec_tx(struct ixgbe_ring *tx_ring, > } > > itd->sa_idx = xs->xso.offload_handle - IXGBE_IPSEC_BASE_TX_INDEX; > - if (unlikely(itd->sa_idx > IXGBE_IPSEC_MAX_SA_COUNT)) { > + if (unlikely(itd->sa_idx >= IXGBE_IPSEC_MAX_SA_COUNT)) { > netdev_err(tx_ring->netdev, "%s: bad sa_idx=%d handle=%lu\n", > __func__, itd->sa_idx, xs->xso.offload_handle); > return 0; >