Commit c8ba7ad2 authored by Maciej Grochowski's avatar Maciej Grochowski Committed by Jon Mason
Browse files

ntb: ntb_hw_switchtec: Fix array-index-out-of-bounds access 



Number of MW LUTs depends on NTB configuration and can be set to MAX_MWS,
This patch protects against invalid index out of bounds access to mw_sizes
When invalid access print message to user that configuration is not valid.

Signed-off-by: default avatarMaciej Grochowski <Maciej.Grochowski@sony.com>
Signed-off-by: default avatarJon Mason <jdmason@kudzu.us>
parent 186615f8

drivers/ntb/hw/mscc/ntb_hw_switchtec.c

+6 −0
Original line number Diff line number Diff line
@@ -1316,6 +1316,12 @@ static void switchtec_ntb_init_shared(struct switchtec_ntb *sndev) 
	for (i = 0; i < sndev->nr_lut_mw; i++) {

		int idx = sndev->nr_direct_mw + i;



		if (idx >= MAX_MWS) {

			dev_err(&sndev->stdev->dev,

				"Total number of MW cannot be bigger than %d", MAX_MWS);

			break;

		}



		sndev->self_shared->mw_sizes[idx] = LUT_SIZE;

	}

}