diff options
| author | Colin Ian King | 2018-06-30 21:39:24 +0100 |
|---|---|---|
| committer | David S. Miller | 2018-07-02 20:35:33 +0900 |
| commit | c02462d8a3e96d99967fb26fca7375d449328ce6 (patch) | |
| tree | b2f16ab0e4ee8515a885314343cd9cd4638fd5aa /drivers/net/netdevsim | |
| parent | 97680ade43dc6a8ad2451389d66b0492458196d4 (diff) | |
netdevsim: fix sa_idx out of bounds check
Currently if sa_idx is equal to NSIM_IPSEC_MAX_SA_COUNT then
an out-of-bounds read on ipsec->sa will occur. Fix the
incorrect bounds check by using >= rather than >.
Detected by CoverityScan, CID#1470226 ("Out-of-bounds-read")
Fixes: 7699353da875 ("netdevsim: add ipsec offload testing")
Signed-off-by: Colin Ian King <colin.king@canonical.com>
Acked-by: Shannon Nelson <shannon.nelson@oracle.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'drivers/net/netdevsim')
| -rw-r--r-- | drivers/net/netdevsim/ipsec.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/drivers/net/netdevsim/ipsec.c b/drivers/net/netdevsim/ipsec.c index ceff544510b9..2dcf6cc269d0 100644 --- a/drivers/net/netdevsim/ipsec.c +++ b/drivers/net/netdevsim/ipsec.c @@ -249,7 +249,7 @@ bool nsim_ipsec_tx(struct netdevsim *ns, struct sk_buff *skb) } sa_idx = xs->xso.offload_handle & ~NSIM_IPSEC_VALID; - if (unlikely(sa_idx > NSIM_IPSEC_MAX_SA_COUNT)) { + if (unlikely(sa_idx >= NSIM_IPSEC_MAX_SA_COUNT)) { netdev_err(ns->netdev, "bad sa_idx=%d max=%d\n", sa_idx, NSIM_IPSEC_MAX_SA_COUNT); return false; |