kevin/linux
1
Fork 0
Code

net: pse-pd: Fix out of bound for loop

Browse Source 
Adjust the loop limit to prevent out-of-bounds access when iterating over
PI structures. The loop should not reach the index pcdev->nr_lines since
we allocate exactly pcdev->nr_lines number of PI structures. This fix
ensures proper bounds are maintained during iterations.

Fixes: 9be9567a7c ("net: pse-pd: Add support for PSE PIs")
Signed-off-by: Kory Maincent <kory.maincent@bootlin.com>
Reviewed-by: Simon Horman <horms@kernel.org>
Acked-by: Oleksij Rempel <o.rempel@pengutronix.de>
Message-ID: <20241015130255.125508-1-kory.maincent@bootlin.com>
Signed-off-by: Andrew Lunn <andrew@lunn.ch>
This commit is contained in:
Kory Maincent 2024-10-15 15:02:54 +02:00 committed by Andrew Lunn
parent 07d6bf634b
commit f2767a4195
1 changed files with 2 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
drivers/net/pse-pd/pse_core.c
View File

@ -113,7 +113,7 @@ static void pse_release_pis(struct pse_controller_dev *pcdev)
{
int i;
for (i = 0; i <= pcdev->nr_lines; i++) {
for (i = 0; i < pcdev->nr_lines; i++) {
of_node_put(pcdev->pi[i].pairset[0].np);
of_node_put(pcdev->pi[i].pairset[1].np);
of_node_put(pcdev->pi[i].np);
@ -647,7 +647,7 @@ static int of_pse_match_pi(struct pse_controller_dev *pcdev,
{
int i;
for (i = 0; i <= pcdev->nr_lines; i++) {
for (i = 0; i < pcdev->nr_lines; i++) {
if (pcdev->pi[i].np == np)
return i;
}