net: dsa: Test array index before use

ffainelli · davem330 · commit 8f5063e97f39 · 2015-07-11T23:25:16.000-07:00
port_index is used an index into an array, and this information comes from Device Tree, make sure that port_index is not equal to the array size before using it. Move the check against port_index earlier in the loop. Fixes: 5e95329: ("dsa: add device tree bindings to register DSA switches") Reported-by: Dan Carpenter <dan.carpenter@oracle.com> Signed-off-by: Florian Fainelli <f.fainelli@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net>
diff --git a/net/dsa/dsa.c b/net/dsa/dsa.c
@@ -642,6 +642,8 @@ static int dsa_of_probe(struct device *dev)
 				continue;
 
 			port_index = be32_to_cpup(port_reg);
+			if (port_index >= DSA_MAX_PORTS)
+				break;
 
 			port_name = of_get_property(port, "label", NULL);
 			if (!port_name)
@@ -666,8 +668,6 @@ static int dsa_of_probe(struct device *dev)
 					goto out_free_chip;
 			}
 
-			if (port_index == DSA_MAX_PORTS)
-				break;
 		}
 	}
 

Original file line number	Diff line number	Diff line change
`@@ -642,6 +642,8 @@ static int dsa_of_probe(struct device *dev)`
`642`	`642`	`continue;`
`643`	`643`
`644`	`644`	`port_index = be32_to_cpup(port_reg);`
	`645`	`+ if (port_index >= DSA_MAX_PORTS)`
	`646`	`+ break;`
`645`	`647`
`646`	`648`	`port_name = of_get_property(port, "label", NULL);`
`647`	`649`	`if (!port_name)`
`@@ -666,8 +668,6 @@ static int dsa_of_probe(struct device *dev)`
`666`	`668`	`goto out_free_chip;`
`667`	`669`	`}`
`668`	`670`
`669`		`- if (port_index == DSA_MAX_PORTS)`
`670`		`- break;`
`671`	`671`	`}`
`672`	`672`	`}`
`673`	`673`