shinys000114/linux
1
0
Fork 0
mirror of https://github.com/hardkernel/linux.git synced 2026-06-08 03:40:35 +09:00
Code Issues Packages Projects Releases Wiki Activity

virtchnl: Fix off by one error

Browse Source 
[ Upstream commit 843faff87a ]

When calculating the valid length for a VIRTCHNL_OP_ENABLE_CHANNELS
message, we accidentally allowed messages with one extra
virtchnl_channel_info structure on the end. This happened due
to an off by one error, because we forgot that valid_len already
accounted for one virtchnl_channel_info structure, so we need to
subtract one from the num_tc value.

Signed-off-by: Alice Michael <alice.michael@intel.com>
Tested-by: Andrew Bowers <andrewx.bowers@intel.com>
Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
This commit is contained in:
Alice Michael
2018-10-26 14:33:31 -07:00
committed by Greg Kroah-Hartman
parent ea962fa132
commit d5be9df067
1 changed files with 2 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
include/linux/avf/virtchnl.h
View File

@@ -798,8 +798,8 @@ virtchnl_vc_validate_vf_msg(struct virtchnl_version_info *ver, u32 v_opcode,
if (msglen >= valid_len) {
struct virtchnl_tc_info *vti =
(struct virtchnl_tc_info *)msg;
valid_len += vti->num_tc *
sizeof(struct virtchnl_channel_info);
valid_len += (vti->num_tc - 1) *
sizeof(struct virtchnl_channel_info);
if (vti->num_tc == 0)
err_msg_format = true;
}