From: Joel Granados <j.granados@xxxxxxxxxxx> This commit comes at the tail end of a greater effort to remove the empty elements at the end of the ctl_table arrays (sentinels) which will reduce the overall build time size of the kernel and run time memory bloat by ~64 bytes per sentinel (further information Link : https://lore.kernel.org/all/ZO5Yx5JFogGi%2FcBo@xxxxxxxxxxxxxxxxxxxxxx/) When we remove the sentinel from ax25_param_table a buffer overflow shows its ugly head. The sentinel's data element used to be changed when CONFIG_AX25_DAMA_SLAVE was not defined. This did not have any adverse effects as we still stopped on the sentinel because of its null procname. But now that we do not have the sentinel element, we are careful to check ax25_param_table's size. Signed-off-by: Joel Granados <j.granados@xxxxxxxxxxx> --- net/ax25/sysctl_net_ax25.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) diff --git a/net/ax25/sysctl_net_ax25.c b/net/ax25/sysctl_net_ax25.c index db66e11e7fe8..2ee375a6a69c 100644 --- a/net/ax25/sysctl_net_ax25.c +++ b/net/ax25/sysctl_net_ax25.c @@ -141,8 +141,7 @@ static const struct ctl_table ax25_param_table[] = { .extra2 = &max_ds_timeout }, #endif - - { } /* that's all, folks! */ +/* that's all, folks! */ }; int ax25_register_dev_sysctl(ax25_dev *ax25_dev) @@ -155,7 +154,7 @@ int ax25_register_dev_sysctl(ax25_dev *ax25_dev) if (!table) return -ENOMEM; - for (k = 0; k < AX25_MAX_VALUES; k++) + for (k = 0; k < AX25_MAX_VALUES && k < ARRAY_SIZE(ax25_param_table); k++) table[k].data = &ax25_dev->values[k]; snprintf(path, sizeof(path), "net/ax25/%s", ax25_dev->dev->name); -- 2.43.0
