summaryrefslogtreecommitdiffstats
path: root/include/linux/avf
diff options
context:
space:
mode:
authorAlice Michael <alice.michael@intel.com>2018-10-26 14:33:31 -0700
committerJeff Kirsher <jeffrey.t.kirsher@intel.com>2018-11-14 10:56:33 -0800
commit843faff87af261bf55eda719a06087af0486a168 (patch)
tree815fdca8b6ff448ebc254a8250b6c6d3da744b66 /include/linux/avf
parentc9a983058ad6ffa59b950b87e4888a43c12ebb26 (diff)
downloadlinux-stable-843faff87af261bf55eda719a06087af0486a168.tar.gz
linux-stable-843faff87af261bf55eda719a06087af0486a168.tar.bz2
linux-stable-843faff87af261bf55eda719a06087af0486a168.zip
virtchnl: Fix off by one error
When calculating the valid length for a VIRTCHNL_OP_ENABLE_CHANNELS message, we accidentally allowed messages with one extra virtchnl_channel_info structure on the end. This happened due to an off by one error, because we forgot that valid_len already accounted for one virtchnl_channel_info structure, so we need to subtract one from the num_tc value. Signed-off-by: Alice Michael <alice.michael@intel.com> Tested-by: Andrew Bowers <andrewx.bowers@intel.com> Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
Diffstat (limited to 'include/linux/avf')
-rw-r--r--include/linux/avf/virtchnl.h4
1 files changed, 2 insertions, 2 deletions
diff --git a/include/linux/avf/virtchnl.h b/include/linux/avf/virtchnl.h
index 3130dec40b93..7605b5919c3a 100644
--- a/include/linux/avf/virtchnl.h
+++ b/include/linux/avf/virtchnl.h
@@ -819,8 +819,8 @@ virtchnl_vc_validate_vf_msg(struct virtchnl_version_info *ver, u32 v_opcode,
if (msglen >= valid_len) {
struct virtchnl_tc_info *vti =
(struct virtchnl_tc_info *)msg;
- valid_len += vti->num_tc *
- sizeof(struct virtchnl_channel_info);
+ valid_len += (vti->num_tc - 1) *
+ sizeof(struct virtchnl_channel_info);
if (vti->num_tc == 0)
err_msg_format = true;
}