* Re: Patch "6lowpan: iphc: Fix an off-by-one check of array index" has been added to the 4.9-stable tree
[not found] <20210913032220.5147A600D4@mail.kernel.org>
@ 2021-09-13 7:45 ` Greg KH
0 siblings, 0 replies; only message in thread
From: Greg KH @ 2021-09-13 7:45 UTC (permalink / raw)
To: linux-kernel; +Cc: colin.king, stable-commits
On Sun, Sep 12, 2021 at 11:22:19PM -0400, Sasha Levin wrote:
> This is a note to let you know that I've just added the patch titled
>
> 6lowpan: iphc: Fix an off-by-one check of array index
>
> to the 4.9-stable tree which can be found at:
> http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary
>
> The filename of the patch is:
> 6lowpan-iphc-fix-an-off-by-one-check-of-array-index.patch
> and it can be found in the queue-4.9 subdirectory.
>
> If you, or anyone else, feels it should not be added to the stable tree,
> please let <stable@vger.kernel.org> know about it.
>
>
>
> commit 68c66a31cc9a38a26a89f9594945390a09355728
> Author: Colin Ian King <colin.king@canonical.com>
> Date: Mon Jul 12 13:14:40 2021 +0100
>
> 6lowpan: iphc: Fix an off-by-one check of array index
>
> [ Upstream commit 9af417610b6142e826fd1ee8ba7ff3e9a2133a5a ]
>
> The bounds check of id is off-by-one and the comparison should
> be >= rather >. Currently the WARN_ON_ONCE check does not stop
> the out of range indexing of &ldev->ctx.table[id] so also add
> a return path if the bounds are out of range.
>
> Addresses-Coverity: ("Illegal address computation").
> Fixes: 5609c185f24d ("6lowpan: iphc: add support for stateful compression")
> Signed-off-by: Colin Ian King <colin.king@canonical.com>
> Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
> Signed-off-by: Sasha Levin <sashal@kernel.org>
>
> diff --git a/net/6lowpan/debugfs.c b/net/6lowpan/debugfs.c
> index 24915e0bb9ea..2a05c5b5005b 100644
> --- a/net/6lowpan/debugfs.c
> +++ b/net/6lowpan/debugfs.c
> @@ -176,7 +176,8 @@ static int lowpan_dev_debugfs_ctx_init(struct net_device *dev,
> struct dentry *dentry, *root;
> char buf[32];
>
> - WARN_ON_ONCE(id > LOWPAN_IPHC_CTX_TABLE_SIZE);
> + if (WARN_ON_ONCE(id >= LOWPAN_IPHC_CTX_TABLE_SIZE))
> + return;
>
> sprintf(buf, "%d", id);
>
Not the correct return type for this tree, or the 4.14 tree, so dropping
it from those queues as it adds a build warning.
thanks,
greg k-h
^ permalink raw reply [flat|nested] only message in thread