net: dsa: bcm_sf2: fix buffer overflow doing set_rxnfc
authorDan Carpenter <dan.carpenter@oracle.com>
Tue, 30 Apr 2019 10:44:19 +0000 (13:44 +0300)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Sun, 5 May 2019 12:42:38 +0000 (14:42 +0200)
commitb48a0a1207e9033bbb16995a1a091f499710538e
treea5962687dc6ff4a92607cde9b13cd60898d7354b
parent485f382f2c6da326e5ceea085f45257c71f6f907
net: dsa: bcm_sf2: fix buffer overflow doing set_rxnfc

[ Upstream commit f949a12fd697479f68d99dc65e9bbab68ee49043 ]

The "fs->location" is a u32 that comes from the user in ethtool_set_rxnfc().
We can't pass unclamped values to test_bit() or it results in an out of
bounds access beyond the end of the bitmap.

Fixes: 7318166cacad ("net: dsa: bcm_sf2: Add support for ethtool::rxnfc")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
drivers/net/dsa/bcm_sf2_cfp.c