Commit 65dd68c7 authored Mar 30, 2020 by Florian Fainelli Committed by Greg Kroah-Hartman Apr 23, 2020

net: dsa: bcm_sf2: Fix overflow checks

commit d0802dc411f469569a537283b6f3833af47aece9 upstream.

Commit f949a12fd697 ("net: dsa: bcm_sf2: fix buffer overflow doing
set_rxnfc") tried to fix the some user controlled buffer overflows in
bcm_sf2_cfp_rule_set() and bcm_sf2_cfp_rule_del() but the fix was using
CFP_NUM_RULES, which while it is correct not to overflow the bitmaps, is
not representative of what the device actually supports. Correct that by
using bcm_sf2_cfp_rule_size() instead.

The latter subtracts the number of rules by 1, so change the checks from
greater than or equal to greater than accordingly.

Fixes: f949a12fd697 ("net: dsa: bcm_sf2: fix buffer overflow doing set_rxnfc")
Signed-off-by: Florian Fainelli <f.fainelli@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

parent 8b10cf2d

drivers/net/dsa/bcm_sf2_cfp.c

+3 −6

Original line number	Diff line number	Diff line
		@@ -742,17 +742,14 @@ static int bcm_sf2_cfp_rule_set(struct dsa_switch *ds, int port,
		fs->m_ext.data[1]))
		return -EINVAL;

		if (fs->location != RX_CLS_LOC_ANY && fs->location >= CFP_NUM_RULES)
		if (fs->location != RX_CLS_LOC_ANY &&
		fs->location > bcm_sf2_cfp_rule_size(priv))
		return -EINVAL;

		if (fs->location != RX_CLS_LOC_ANY &&
		test_bit(fs->location, priv->cfp.used))
		return -EBUSY;

		if (fs->location != RX_CLS_LOC_ANY &&
		fs->location > bcm_sf2_cfp_rule_size(priv))
		return -EINVAL;

		/* This rule is a Wake-on-LAN filter and we must specifically
		* target the CPU port in order for it to be working.
		*/
		@@ -839,7 +836,7 @@ static int bcm_sf2_cfp_rule_del(struct bcm_sf2_priv *priv, int port,
		u32 next_loc = 0;
		int ret;

		if (loc >= CFP_NUM_RULES)
		if (loc > bcm_sf2_cfp_rule_size(priv))
		return -EINVAL;

		/* Refuse deleting unused rules, and those that are not unique since