Commit c02462d8 authored Jun 30, 2018 by Colin Ian King Committed by David S. Miller Jul 02, 2018

netdevsim: fix sa_idx out of bounds check



Currently if sa_idx is equal to NSIM_IPSEC_MAX_SA_COUNT then
an out-of-bounds read on ipsec->sa will occur. Fix the
incorrect bounds check by using >= rather than >.

Detected by CoverityScan, CID#1470226 ("Out-of-bounds-read")

Fixes: 7699353d ("netdevsim: add ipsec offload testing")
Signed-off-by: Colin Ian King <colin.king@canonical.com>
Acked-by: Shannon Nelson <shannon.nelson@oracle.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

parent 97680ade

drivers/net/netdevsim/ipsec.c

+1 −1

Original line number	Diff line number	Diff line
		@@ -249,7 +249,7 @@ bool nsim_ipsec_tx(struct netdevsim ns, struct sk_buff skb)
		}

		sa_idx = xs->xso.offload_handle & ~NSIM_IPSEC_VALID;
		if (unlikely(sa_idx > NSIM_IPSEC_MAX_SA_COUNT)) {
		if (unlikely(sa_idx >= NSIM_IPSEC_MAX_SA_COUNT)) {
		netdev_err(ns->netdev, "bad sa_idx=%d max=%d\n",
		sa_idx, NSIM_IPSEC_MAX_SA_COUNT);
		return false;