From mboxrd@z Thu Jan 1 00:00:00 1970 Delivery-date: Wed, 26 Aug 2026 12:00:06 +0200 Received: from mx1.white.stw.pengutronix.de ([2a0a:edc0:0:b01:1d::107]) by lore.white.stw.pengutronix.de with esmtps (TLS1.3) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (Exim 4.96) (envelope-from ) id 1wzAQP-007ONl-2o for lore@lore.pengutronix.de; Wed, 26 Aug 2026 12:00:06 +0200 Received: from bombadil.infradead.org (bombadil.infradead.org [IPv6:2607:7c80:54:3::133]) by mx1.white.stw.pengutronix.de (Postfix) with ESMTPS id 38535201552 for ; Wed, 26 Aug 2026 12:00:06 +0200 (CEST) Authentication-Results: mx1.white.stw.pengutronix.de; dkim=pass header.d=lists.infradead.org header.s=bombadil.20210309 header.b=1gvckzGn; dmarc=none; spf=pass (mx1.white.stw.pengutronix.de: domain of "barebox-bounces+lore=pengutronix.de@lists.infradead.org" designates 2607:7c80:54:3::133 as permitted sender) smtp.mailfrom="barebox-bounces+lore=pengutronix.de@lists.infradead.org" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.infradead.org; s=bombadil.20210309; h=Sender:List-Subscribe:List-Help :List-Post:List-Archive:List-Unsubscribe:List-Id:Content-Transfer-Encoding: MIME-Version:Message-ID:Date:Subject:Cc:To:From:Reply-To:Content-Type: Content-ID:Content-Description:Resent-Date:Resent-From:Resent-Sender: Resent-To:Resent-Cc:Resent-Message-ID:In-Reply-To:References:List-Owner; bh=HE4UtvIcPlL55gH7m8u3JomQGdK0uEaHR8k6elGWR68=; b=1gvckzGnFfdaynbL80M56M/Zi/ HVO52oTtWl3we8U8LDUvpOgugxGPSu5qBW9RajC8/o2lscy1G9LiodHl6RYnkDkUVn4JPgvQSVaWL SgWlG+xacY41aQLQLIG41Rd8osQBAn/mZzEL641JK7Y49hjrxPIJr93bsBZkENFoQcxlpVDwKJD+O 7NBgKADK9DuV5n6TFbqu+A8fIktyPTVUbOj/WG2B+5W7x9ACYbuTw8+26F+BbUQD8z43px7k4Oo5k PSMsDiyAQVidqhn749PErwlSeW5foYNBPrjRHm7l5KJXDeRQKzjrpATCWELKvANXaHQNcu2CQazBq LVmsy2HQ==; Received: from localhost ([::1] helo=bombadil.infradead.org) by bombadil.infradead.org with esmtp (Exim 4.99.1 #2 (Red Hat Linux)) id 1wzAPH-00000002FTv-1k57; Wed, 26 Aug 2026 09:58:55 +0000 Received: from mx1.white.stw.pengutronix.de ([185.203.200.13]) by bombadil.infradead.org with esmtps (Exim 4.99.1 #2 (Red Hat Linux)) id 1wzAPE-00000002FTU-0SLL for barebox@lists.infradead.org; Wed, 26 Aug 2026 09:58:54 +0000 Received: from drehscheibe.grey.stw.pengutronix.de (drehscheibe.grey.stw.pengutronix.de [IPv6:2a0a:edc0:0:c01:1d::a2]) (Authenticated sender: relay-from-drehscheibe.grey.stw.pengutronix.de) by mx1.white.stw.pengutronix.de (Postfix) with ESMTPSA id 39013200EE3; Wed, 26 Aug 2026 11:58:50 +0200 (CEST) Received: from dude05.red.stw.pengutronix.de ([2a0a:edc0:0:1101:1d::54]) by drehscheibe.grey.stw.pengutronix.de with esmtps (TLS1.3) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (Exim 4.96) (envelope-from ) id 1wzAPC-003Q1w-0P; Wed, 26 Aug 2026 11:58:50 +0200 Received: from [::1] (helo=dude05.red.stw.pengutronix.de) by dude05.red.stw.pengutronix.de with esmtp (Exim 4.98.2) (envelope-from ) id 1wzAPC-0000000BBlp-06jp; Wed, 26 Aug 2026 11:58:50 +0200 From: Ahmad Fatoum To: barebox@lists.infradead.org Cc: Ahmad Fatoum Subject: [PATCH] net: dsa: don't index the port array one entry past its end Date: Wed, 26 Aug 2026 11:58:42 +0200 Message-ID: <20260826095844.2666779-1-a.fatoum@pengutronix.de> X-Mailer: git-send-email 2.47.3 MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-CRM114-Version: 20100106-BlameMichelson ( TRE 0.9.0 (BSD) ) MR-646709E3 X-CRM114-CacheID: sfid-20260826_025852_777132_4E02B368 X-CRM114-Status: GOOD ( 10.20 ) X-Spam-Score: -1.9 (-) X-Spam-Report: Spam detection software, running on the system "bombadil.infradead.org", has NOT identified this incoming email as spam. The original message has been attached to this so you can view it or label similar future email. If you have any questions, see the administrator of that system for details. Content preview: dsa_rx_preprocessor() takes the source port out of the received frame and rejects it with if (port > DSA_MAX_PORTS) return -ERANGE; before reading ds->dp[port], but the array is declared as Content analysis details: (-1.9 points, 5.0 required) pts rule name description ---- ---------------------- -------------------------------------------------- -0.0 SPF_HELO_PASS SPF: HELO matches SPF record -0.0 SPF_PASS SPF: sender matches SPF record -1.9 BAYES_00 BODY: Bayes spam probability is 0 to 1% [score: 0.0000] 0.0 DMARC_MISSING Missing DMARC policy X-BeenThere: barebox@lists.infradead.org X-Mailman-Version: 2.1.34 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: "barebox" X-Spamd-Result: default: False [-56.21 / 15.00]; RECEIVED_AUTHENTICATED_BY_MX1(-50.00)[]; BAYES_HAM(-3.00)[100.00%]; DWL_DNSWL_MED(-2.00)[infradead.org:dkim]; KNOWN_LIST_ID(-1.00)[barebox.lists.infradead.org]; MID_CONTAINS_FROM(1.00)[]; RCVD_DKIM_ARC_DNSWL_MED(-0.50)[]; R_MISSING_CHARSET(0.50)[]; RCVD_IN_DNSWL_MED(-0.40)[2607:7c80:54:3::133:from,2a0a:edc0:0:1101:1d::54:received]; MAILLIST(-0.20)[mailman]; R_SPF_ALLOW(-0.20)[+mx:c]; R_DKIM_ALLOW(-0.20)[lists.infradead.org:s=bombadil.20210309]; RCVD_IN_DNSWL_LOW(-0.10)[2a0a:edc0:0:c01:1d::a2:received]; MIME_GOOD(-0.10)[text/plain]; HAS_LIST_UNSUB(-0.01)[]; RCPT_COUNT_TWO(0.00)[2]; TO_DN_SOME(0.00)[]; MIME_TRACE(0.00)[0:+]; ARC_NA(0.00)[]; RECEIVED_HELO_LOCALHOST(0.00)[]; DMARC_NA(0.00)[pengutronix.de]; DKIM_TRACE(0.00)[lists.infradead.org:+]; TAGGED_FROM(0.00)[lore=pengutronix.de]; FROM_NEQ_ENVFROM(0.00)[a.fatoum@pengutronix.de,barebox-bounces@lists.infradead.org]; FROM_HAS_DN(0.00)[]; RCVD_TLS_LAST(0.00)[]; RCVD_COUNT_FIVE(0.00)[5]; RCVD_VIA_SMTP_AUTH(0.00)[]; NEURAL_HAM(-0.00)[-1.000]; ASN(0.00)[asn:7247, ipnet:2607:7c80:54::/48, country:US]; FORGED_SENDER_MAILLIST(0.00)[] X-Rspamd-Action: no action X-Rspamd-Server: mx1 X-Stat-Signature: zpo5qw96pj7iuf7ff1mgwn4sk5jd99gj X-Rspamd-Queue-Id: 38535201552 dsa_rx_preprocessor() takes the source port out of the received frame and rejects it with if (port > DSA_MAX_PORTS) return -ERANGE; before reading ds->dp[port], but the array is declared as struct dsa_port *dp[DSA_MAX_PORTS]; so the last accepted value indexes one entry past its end. Fix this off-by-one. Fixes: d64486483505 ("net: add DSA framework to support basic switch functionality") Assisted-by: Claude:opus-5 Signed-off-by: Ahmad Fatoum --- drivers/net/dsa.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/net/dsa.c b/drivers/net/dsa.c index 8eb12522999f..7b2de7324e4a 100644 --- a/drivers/net/dsa.c +++ b/drivers/net/dsa.c @@ -311,7 +311,7 @@ static int dsa_rx_preprocessor(struct eth_device *edev, unsigned char **packet, *packet += ds->needed_headroom; *length -= ds->needed_rx_tailroom; - if (port > DSA_MAX_PORTS) + if (port >= DSA_MAX_PORTS) return -ERANGE; dp = ds->dp[port]; -- 2.47.3