This is a note to let you know that I've just added the patch titled
net: pse-pd: Fix out of bound for loop
to the 6.11-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary
The filename of the patch is:
net-pse-pd-fix-out-of-bound-for-loop.patch
and it can be found in the queue-6.11 subdirectory.
If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.
commit 90cd820ada011f5d0b9be08d394c9f3736a06da8
Author: Kory Maincent <kory.maincent@xxxxxxxxxxx>
Date: Tue Oct 15 15:02:54 2024 +0200
net: pse-pd: Fix out of bound for loop
[ Upstream commit f2767a41959e60763949c73ee180e40c686e807e ]
Adjust the loop limit to prevent out-of-bounds access when iterating over
PI structures. The loop should not reach the index pcdev->nr_lines since
we allocate exactly pcdev->nr_lines number of PI structures. This fix
ensures proper bounds are maintained during iterations.
Fixes: 9be9567a7c59 ("net: pse-pd: Add support for PSE PIs")
Signed-off-by: Kory Maincent <kory.maincent@xxxxxxxxxxx>
Reviewed-by: Simon Horman <horms@xxxxxxxxxx>
Acked-by: Oleksij Rempel <o.rempel@xxxxxxxxxxxxxx>
Message-ID: <20241015130255.125508-1-kory.maincent@xxxxxxxxxxx>
Signed-off-by: Andrew Lunn <andrew@xxxxxxx>
Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>
diff --git a/drivers/net/pse-pd/pse_core.c b/drivers/net/pse-pd/pse_core.c
index f8e6854781e6e..2906ce173f66c 100644
--- a/drivers/net/pse-pd/pse_core.c
+++ b/drivers/net/pse-pd/pse_core.c
@@ -113,7 +113,7 @@ static void pse_release_pis(struct pse_controller_dev *pcdev)
{
int i;
- for (i = 0; i <= pcdev->nr_lines; i++) {
+ for (i = 0; i < pcdev->nr_lines; i++) {
of_node_put(pcdev->pi[i].pairset[0].np);
of_node_put(pcdev->pi[i].pairset[1].np);
of_node_put(pcdev->pi[i].np);
@@ -647,7 +647,7 @@ static int of_pse_match_pi(struct pse_controller_dev *pcdev,
{
int i;
- for (i = 0; i <= pcdev->nr_lines; i++) {
+ for (i = 0; i < pcdev->nr_lines; i++) {
if (pcdev->pi[i].np == np)
return i;
}
