Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux

net: pse-pd: Fix out of bound for loop

Adjust the loop limit to prevent out-of-bounds access when iterating over
PI structures. The loop should not reach the index pcdev->nr_lines since
we allocate exactly pcdev->nr_lines number of PI structures. This fix
ensures proper bounds are maintained during iterations.

Fixes: 9be9567a7c59 ("net: pse-pd: Add support for PSE PIs")
Signed-off-by: Kory Maincent <kory.maincent@bootlin.com>
Reviewed-by: Simon Horman <horms@kernel.org>
Acked-by: Oleksij Rempel <o.rempel@pengutronix.de>
Message-ID: <20241015130255.125508-1-kory.maincent@bootlin.com>
Signed-off-by: Andrew Lunn <andrew@lunn.ch>

authored by

Kory Maincent and committed by
Andrew Lunn
f2767a41 07d6bf63

+2 -2
+2 -2
drivers/net/pse-pd/pse_core.c
··· 113 113 { 114 114 int i; 115 115 116 - for (i = 0; i <= pcdev->nr_lines; i++) { 116 + for (i = 0; i < pcdev->nr_lines; i++) { 117 117 of_node_put(pcdev->pi[i].pairset[0].np); 118 118 of_node_put(pcdev->pi[i].pairset[1].np); 119 119 of_node_put(pcdev->pi[i].np); ··· 647 647 { 648 648 int i; 649 649 650 - for (i = 0; i <= pcdev->nr_lines; i++) { 650 + for (i = 0; i < pcdev->nr_lines; i++) { 651 651 if (pcdev->pi[i].np == np) 652 652 return i; 653 653 }