From: Greg Kroah-Hartman Date: Tue, 21 Sep 2021 06:37:55 +0000 (+0200) Subject: 5.14-stable patches X-Git-Tag: v4.4.284~11 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=8b4caf8273d21c332e2ed8d5f78e4855db848ed3;p=thirdparty%2Fkernel%2Fstable-queue.git 5.14-stable patches added patches: net-dsa-bcm_sf2-fix-array-overrun-in-bcm_sf2_num_active_ports.patch --- diff --git a/queue-5.14/net-dsa-bcm_sf2-fix-array-overrun-in-bcm_sf2_num_active_ports.patch b/queue-5.14/net-dsa-bcm_sf2-fix-array-overrun-in-bcm_sf2_num_active_ports.patch new file mode 100644 index 00000000000..7336c54e7b7 --- /dev/null +++ b/queue-5.14/net-dsa-bcm_sf2-fix-array-overrun-in-bcm_sf2_num_active_ports.patch @@ -0,0 +1,38 @@ +From 02319bf15acf54004216e40ac9c171437f24be24 Mon Sep 17 00:00:00 2001 +From: Florian Fainelli +Date: Thu, 16 Sep 2021 14:33:35 -0700 +Subject: net: dsa: bcm_sf2: Fix array overrun in bcm_sf2_num_active_ports() + +From: Florian Fainelli + +commit 02319bf15acf54004216e40ac9c171437f24be24 upstream. + +After d12e1c464988 ("net: dsa: b53: Set correct number of ports in the +DSA struct") we stopped setting dsa_switch::num_ports to DSA_MAX_PORTS, +which created an off by one error between the statically allocated +bcm_sf2_priv::port_sts array (of size DSA_MAX_PORTS). When +dsa_is_cpu_port() is used, we end-up accessing an out of bounds member +and causing a NPD. + +Fix this by iterating with the appropriate port count using +ds->num_ports. + +Fixes: d12e1c464988 ("net: dsa: b53: Set correct number of ports in the DSA struct") +Signed-off-by: Florian Fainelli +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/dsa/bcm_sf2.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/net/dsa/bcm_sf2.c ++++ b/drivers/net/dsa/bcm_sf2.c +@@ -68,7 +68,7 @@ static unsigned int bcm_sf2_num_active_p + struct bcm_sf2_priv *priv = bcm_sf2_to_priv(ds); + unsigned int port, count = 0; + +- for (port = 0; port < ARRAY_SIZE(priv->port_sts); port++) { ++ for (port = 0; port < ds->num_ports; port++) { + if (dsa_is_cpu_port(ds, port)) + continue; + if (priv->port_sts[port].enabled) diff --git a/queue-5.14/series b/queue-5.14/series index 2616cd8af1f..822499f6372 100644 --- a/queue-5.14/series +++ b/queue-5.14/series @@ -167,3 +167,4 @@ mfd-lpc_sch-rename-gpiobase-to-prevent-build-error.patch cxgb3-fix-oops-on-module-removal.patch net-renesas-sh_eth-fix-freeing-wrong-tx-descriptor.patch bnxt_en-fix-error-recovery-regression.patch +net-dsa-bcm_sf2-fix-array-overrun-in-bcm_sf2_num_active_ports.patch