From 646188c9550f74454dfc172a347dad693e5bfc84 Mon Sep 17 00:00:00 2001 From: Dan Carpenter Date: Tue, 19 Jan 2021 17:53:35 +0300 Subject: net: dsa: Fix off by one in dsa_loop_port_vlan_add() The > comparison is intended to be >= to prevent reading beyond the end of the ps->vlans[] array. It doesn't affect run time though because the ps->vlans[] array has VLAN_N_VID (4096) elements and the vlan->vid cannot be > 4094 because it is checked earlier. Signed-off-by: Dan Carpenter Acked-by: Florian Fainelli Link: https://lore.kernel.org/r/YAbyb5kBJQlpYCs2@mwanda Signed-off-by: Jakub Kicinski --- drivers/net/dsa/dsa_loop.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/net/dsa/dsa_loop.c b/drivers/net/dsa/dsa_loop.c index 5f69216376fe..8c283f59158b 100644 --- a/drivers/net/dsa/dsa_loop.c +++ b/drivers/net/dsa/dsa_loop.c @@ -207,7 +207,7 @@ static int dsa_loop_port_vlan_add(struct dsa_switch *ds, int port, struct mii_bus *bus = ps->bus; struct dsa_loop_vlan *vl; - if (vlan->vid > ARRAY_SIZE(ps->vlans)) + if (vlan->vid >= ARRAY_SIZE(ps->vlans)) return -ERANGE; /* Just do a sleeping operation to make lockdep checks effective */ -- cgit v1.2.3