5.14-stable patches

added patches:
	net-dsa-bcm_sf2-fix-array-overrun-in-bcm_sf2_num_active_ports.patch

diff --git a/queue-5.14/net-dsa-bcm_sf2-fix-array-overrun-in-bcm_sf2_num_active_ports.patch b/queue-5.14/net-dsa-bcm_sf2-fix-array-overrun-in-bcm_sf2_num_active_ports.patch
new file mode 100644 (file)
index 0000000..7336c54
--- /dev/null
+++ b/queue-5.14/net-dsa-bcm_sf2-fix-array-overrun-in-bcm_sf2_num_active_ports.patch
@@ -0,0 +1,38 @@
+From 02319bf15acf54004216e40ac9c171437f24be24 Mon Sep 17 00:00:00 2001
+From: Florian Fainelli <f.fainelli@gmail.com>
+Date: Thu, 16 Sep 2021 14:33:35 -0700
+Subject: net: dsa: bcm_sf2: Fix array overrun in bcm_sf2_num_active_ports()
+
+From: Florian Fainelli <f.fainelli@gmail.com>
+
+commit 02319bf15acf54004216e40ac9c171437f24be24 upstream.
+
+After d12e1c464988 ("net: dsa: b53: Set correct number of ports in the
+DSA struct") we stopped setting dsa_switch::num_ports to DSA_MAX_PORTS,
+which created an off by one error between the statically allocated
+bcm_sf2_priv::port_sts array (of size DSA_MAX_PORTS). When
+dsa_is_cpu_port() is used, we end-up accessing an out of bounds member
+and causing a NPD.
+
+Fix this by iterating with the appropriate port count using
+ds->num_ports.
+
+Fixes: d12e1c464988 ("net: dsa: b53: Set correct number of ports in the DSA struct")
+Signed-off-by: Florian Fainelli <f.fainelli@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/dsa/bcm_sf2.c |    2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/net/dsa/bcm_sf2.c
++++ b/drivers/net/dsa/bcm_sf2.c
+@@ -68,7 +68,7 @@ static unsigned int bcm_sf2_num_active_p
+       struct bcm_sf2_priv *priv = bcm_sf2_to_priv(ds);
+       unsigned int port, count = 0;
+ 
+-      for (port = 0; port < ARRAY_SIZE(priv->port_sts); port++) {
++      for (port = 0; port < ds->num_ports; port++) {
+               if (dsa_is_cpu_port(ds, port))
+                       continue;
+               if (priv->port_sts[port].enabled)

diff --git a/queue-5.14/series b/queue-5.14/series
index 2616cd8af1f0f8d7dd019051abc4eec92914a00a..822499f6372861b397f76a1b437192547adb35fb 100644 (file)
--- a/queue-5.14/series
+++ b/queue-5.14/series
@@ -167,3 +167,4 @@ mfd-lpc_sch-rename-gpiobase-to-prevent-build-error.patch
 cxgb3-fix-oops-on-module-removal.patch
 net-renesas-sh_eth-fix-freeing-wrong-tx-descriptor.patch
 bnxt_en-fix-error-recovery-regression.patch
+net-dsa-bcm_sf2-fix-array-overrun-in-bcm_sf2_num_active_ports.patch