A DSA frame with an invalid source trunk ID could cause an out-of-bounds read access of dst->lags. This patch adds a check to dsa_lag_by_id() to validate the LAG ID is not zero, and is less than or equal to dst->lags_len. (The LAG ID is derived by adding one to the source trunk ID.) Note: this is in the fast path for any frames within a trunk. Signed-off-by: Luke Howard --- include/net/dsa.h | 3 +++ 1 file changed, 3 insertions(+) diff --git a/include/net/dsa.h b/include/net/dsa.h index 2e148823c366c..67672c5ff22e5 100644 --- a/include/net/dsa.h +++ b/include/net/dsa.h @@ -180,6 +180,9 @@ struct dsa_switch_tree { static inline struct dsa_lag *dsa_lag_by_id(struct dsa_switch_tree *dst, unsigned int id) { + if (unlikely(id == 0 || id > dst->lags_len)) + return NULL; + /* DSA LAG IDs are one-based, dst->lags is zero-based */ return dst->lags[id - 1]; } -- 2.43.0