net: pse-pd: Fix out of bound for loop

[PATCH net] net: pse-pd: Fix out of bound for loop

Posted by Kory Maincent 1 month, 1 week ago

Adjust the loop limit to prevent out-of-bounds access when iterating over
PI structures. The loop should not reach the index pcdev->nr_lines since
we allocate exactly pcdev->nr_lines number of PI structures. This fix
ensures proper bounds are maintained during iterations.

Fixes: 9be9567a7c59 ("net: pse-pd: Add support for PSE PIs")
Signed-off-by: Kory Maincent <kory.maincent@bootlin.com>
---
 drivers/net/pse-pd/pse_core.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/net/pse-pd/pse_core.c b/drivers/net/pse-pd/pse_core.c
index f8e6854781e6..2906ce173f66 100644
--- a/drivers/net/pse-pd/pse_core.c
+++ b/drivers/net/pse-pd/pse_core.c
@@ -113,7 +113,7 @@ static void pse_release_pis(struct pse_controller_dev *pcdev)
 {
 	int i;
 
-	for (i = 0; i <= pcdev->nr_lines; i++) {
+	for (i = 0; i < pcdev->nr_lines; i++) {
 		of_node_put(pcdev->pi[i].pairset[0].np);
 		of_node_put(pcdev->pi[i].pairset[1].np);
 		of_node_put(pcdev->pi[i].np);
@@ -647,7 +647,7 @@ static int of_pse_match_pi(struct pse_controller_dev *pcdev,
 {
 	int i;
 
-	for (i = 0; i <= pcdev->nr_lines; i++) {
+	for (i = 0; i < pcdev->nr_lines; i++) {
 		if (pcdev->pi[i].np == np)
 			return i;
 	}
-- 
2.34.1

Re: [PATCH net] net: pse-pd: Fix out of bound for loop

Posted by Oleksij Rempel 1 month, 1 week ago

On Tue, Oct 15, 2024 at 03:02:54PM +0200, Kory Maincent wrote:
> Adjust the loop limit to prevent out-of-bounds access when iterating over
> PI structures. The loop should not reach the index pcdev->nr_lines since
> we allocate exactly pcdev->nr_lines number of PI structures. This fix
> ensures proper bounds are maintained during iterations.
> 
> Fixes: 9be9567a7c59 ("net: pse-pd: Add support for PSE PIs")
> Signed-off-by: Kory Maincent <kory.maincent@bootlin.com>

Acked-by: Oleksij Rempel <o.rempel@pengutronix.de>

Thank you!

-- 
Pengutronix e.K.                           |                             |
Steuerwalder Str. 21                       | http://www.pengutronix.de/  |
31137 Hildesheim, Germany                  | Phone: +49-5121-206917-0    |
Amtsgericht Hildesheim, HRA 2686           | Fax:   +49-5121-206917-5555 |

Re: [PATCH net] net: pse-pd: Fix out of bound for loop

Posted by Simon Horman 1 month, 1 week ago

On Tue, Oct 15, 2024 at 03:02:54PM +0200, Kory Maincent wrote:
> Adjust the loop limit to prevent out-of-bounds access when iterating over
> PI structures. The loop should not reach the index pcdev->nr_lines since
> we allocate exactly pcdev->nr_lines number of PI structures. This fix
> ensures proper bounds are maintained during iterations.
> 
> Fixes: 9be9567a7c59 ("net: pse-pd: Add support for PSE PIs")
> Signed-off-by: Kory Maincent <kory.maincent@bootlin.com>

Reviewed-by: Simon Horman <horms@kernel.org>