From 5d7cc2b5bda0e40a8fc3dc4d2228c82e9391c255 Mon Sep 17 00:00:00 2001
From: Rustam Subkhankulov <subkhankulov@ispras.ru>
Date: Wed, 17 Aug 2022 03:38:45 +0300
Subject: [PATCH 02/13] net: dsa: sja1105: fix buffer overflow in
sja1105_setup_devlink_regions()
Git-commit: fd8e899cdb5ecaf8e8ee73854a99e10807eef1de
References: git-fixes
Patch-mainline: v6.0-rc2
If an error occurs in dsa_devlink_region_create(), then 'priv->regions'
array will be accessed by negative index '-1'.
Found by Linux Verification Center (linuxtesting.org) with SVACE.
Signed-off-by: Rustam Subkhankulov <subkhankulov@ispras.ru>
Fixes: bf425b82059e ("net: dsa: sja1105: expose static config as devlink region")
Link: https://lore.kernel.org/r/20220817003845.389644-1-subkhankulov@ispras.ru
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Denis Kirjanov <denis.kirjanov@suse.com>
---
drivers/net/dsa/sja1105/sja1105_devlink.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/net/dsa/sja1105/sja1105_devlink.c b/drivers/net/dsa/sja1105/sja1105_devlink.c
index b6a4a16b8c7e..c75eac89acba 100644
--- a/drivers/net/dsa/sja1105/sja1105_devlink.c
+++ b/drivers/net/dsa/sja1105/sja1105_devlink.c
@@ -93,7 +93,7 @@ static int sja1105_setup_devlink_regions(struct dsa_switch *ds)
region = dsa_devlink_region_create(ds, ops, 1, size);
if (IS_ERR(region)) {
- while (i-- >= 0)
+ while (--i >= 0)
dsa_devlink_region_destroy(priv->regions[i]);
return PTR_ERR(region);
}
--
2.16.4