i40e: fix input validation logic for action_meta

commit 9739d5830497812b0bdeaee356ddefbe60830b88 upstream.

Fix condition to check 'greater or equal' to prevent OOB dereference.

Fixes: e284fc280473 ("i40e: Add and delete cloud filter")
Cc: stable@vger.kernel.org
Signed-off-by: Lukasz Czapnik <lukasz.czapnik@intel.com>
Reviewed-by: Aleksandr Loktionov <aleksandr.loktionov@intel.com>
Signed-off-by: Przemek Kitszel <przemyslaw.kitszel@intel.com>
Reviewed-by: Simon Horman <horms@kernel.org>
Tested-by: Rafal Romanowski <rafal.romanowski@intel.com>
Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

diff --git a/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c b/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c
index ae1a3701e60410c40a1266b93fb584e01a46e68a..5a5f65713a7298cb73e48bb7ddff0f3b1a115c55 100644 (file)
--- a/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c
+++ b/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c
@@ -3605,7 +3605,7 @@ static int i40e_validate_cloud_filter(struct i40e_vf *vf,
 
        /* action_meta is TC number here to which the filter is applied */
        if (!tc_filter->action_meta ||
-           tc_filter->action_meta > vf->num_tc) {
+           tc_filter->action_meta >= vf->num_tc) {
                dev_info(&pf->pdev->dev, "VF %d: Invalid TC number %u\n",
                         vf->vf_id, tc_filter->action_meta);
                goto err;