This is a note to let you know that I've just added the patch titled
net: dsa: bcm_sf2: Fix array overrun in bcm_sf2_num_active_ports()
to the 5.10-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary
The filename of the patch is:
net-dsa-bcm_sf2-fix-array-overrun-in-bcm_sf2_num_active_ports.patch
and it can be found in the queue-5.10 subdirectory.
If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.
>From 02319bf15acf54004216e40ac9c171437f24be24 Mon Sep 17 00:00:00 2001
From: Florian Fainelli <f.fainelli@xxxxxxxxx>
Date: Thu, 16 Sep 2021 14:33:35 -0700
Subject: net: dsa: bcm_sf2: Fix array overrun in bcm_sf2_num_active_ports()
From: Florian Fainelli <f.fainelli@xxxxxxxxx>
commit 02319bf15acf54004216e40ac9c171437f24be24 upstream.
After d12e1c464988 ("net: dsa: b53: Set correct number of ports in the
DSA struct") we stopped setting dsa_switch::num_ports to DSA_MAX_PORTS,
which created an off by one error between the statically allocated
bcm_sf2_priv::port_sts array (of size DSA_MAX_PORTS). When
dsa_is_cpu_port() is used, we end-up accessing an out of bounds member
and causing a NPD.
Fix this by iterating with the appropriate port count using
ds->num_ports.
Fixes: d12e1c464988 ("net: dsa: b53: Set correct number of ports in the DSA struct")
Signed-off-by: Florian Fainelli <f.fainelli@xxxxxxxxx>
Signed-off-by: David S. Miller <davem@xxxxxxxxxxxxx>
Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx>
---
drivers/net/dsa/bcm_sf2.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/net/dsa/bcm_sf2.c
+++ b/drivers/net/dsa/bcm_sf2.c
@@ -38,7 +38,7 @@ static unsigned int bcm_sf2_num_active_p
struct bcm_sf2_priv *priv = bcm_sf2_to_priv(ds);
unsigned int port, count = 0;
- for (port = 0; port < ARRAY_SIZE(priv->port_sts); port++) {
+ for (port = 0; port < ds->num_ports; port++) {
if (dsa_is_cpu_port(ds, port))
continue;
if (priv->port_sts[port].enabled)
Patches currently in stable-queue which might be from f.fainelli@xxxxxxxxx are
queue-5.10/pci-of-don-t-fail-devm_pci_alloc_host_bridge-on-miss.patch
queue-5.10/net-dsa-b53-fix-calculating-number-of-switch-ports.patch
queue-5.10/net-dsa-destroy-the-phylink-instance-on-any-error-in-dsa_slave_phy_setup.patch
queue-5.10/net-dsa-tag_rtl4_a-fix-egress-tags.patch
queue-5.10/net-dsa-bcm_sf2-fix-array-overrun-in-bcm_sf2_num_active_ports.patch
queue-5.10/pci-iproc-fix-bcma-probe-resource-handling.patch
queue-5.10/r6040-restore-mdio-clock-frequency-after-mac-reset.patch
