net: bcmasp: Prevent array undereflow in bcmasp_netfilt_get_init()

The "loc" value comes from the user and it can be negative leading to an
an array underflow when we check "priv->net_filters[loc].claimed".  Fix
this by changing the type to u32.

Fixes: c5d511c49587 ("net: bcmasp: Add support for wake on net filters")
Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org>
Reviewed-by: Florian Fainelli <florian.fainelli@broadcom.com>
Reviewed-by: Justin Chen <justin.chen@broadcom.com>
Link: https://lore.kernel.org/r/b3b47b25-01fc-4d9f-a6c3-e037ad4d71d7@moroto.mountain
Signed-off-by: Jakub Kicinski <kuba@kernel.org>

diff --git a/drivers/net/ethernet/broadcom/asp2/bcmasp.c b/drivers/net/ethernet/broadcom/asp2/bcmasp.c
index eb35ced1c8ba7bbd19fc115a137b31cb56bb180d..d63d321f3e7b0124e19093add27cfc252a1f7f71 100644 (file)
--- a/drivers/net/ethernet/broadcom/asp2/bcmasp.c
+++ b/drivers/net/ethernet/broadcom/asp2/bcmasp.c
@@ -640,7 +640,7 @@ bool bcmasp_netfilt_check_dup(struct bcmasp_intf *intf,
  * If no more open filters return NULL
  */
 struct bcmasp_net_filter *bcmasp_netfilt_get_init(struct bcmasp_intf *intf,
-                                                 int loc, bool wake_filter,
+                                                 u32 loc, bool wake_filter,
                                                  bool init)
 {
        struct bcmasp_net_filter *nfilter = NULL;

diff --git a/drivers/net/ethernet/broadcom/asp2/bcmasp.h b/drivers/net/ethernet/broadcom/asp2/bcmasp.h
index 6bfcaa7f95a834040c50d3d1ab3660a9f6cfad4d..5b512f7f5e9499e569458a9d36f6963bc7cf7c43 100644 (file)
--- a/drivers/net/ethernet/broadcom/asp2/bcmasp.h
+++ b/drivers/net/ethernet/broadcom/asp2/bcmasp.h
@@ -566,7 +566,7 @@ void bcmasp_disable_all_filters(struct bcmasp_intf *intf);
 void bcmasp_core_clock_set_intf(struct bcmasp_intf *intf, bool en);
 
 struct bcmasp_net_filter *bcmasp_netfilt_get_init(struct bcmasp_intf *intf,
-                                                 int loc, bool wake_filter,
+                                                 u32 loc, bool wake_filter,
                                                  bool init);
 
 bool bcmasp_netfilt_check_dup(struct bcmasp_intf *intf,