net: lan966x: fix a couple off by one bugs

The lan966x->ports[] array has lan966x->num_phys_ports elements.  These
are assigned in lan966x_probe().  That means the > comparison should be
changed to >=.

The first off by one check is harmless but the second one could lead to
an out of bounds access and a crash.

Fixes: 5ccd66e01cbe ("net: lan966x: add support for interrupts from analyzer")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

diff --git a/drivers/net/ethernet/microchip/lan966x/lan966x_mac.c b/drivers/net/ethernet/microchip/lan966x/lan966x_mac.c
index 2679111ef66960b8171387ced2dd62d15f98cfed..005e56ea5da1204c98e12778aa791b39b56b9dc9 100644 (file)
--- a/drivers/net/ethernet/microchip/lan966x/lan966x_mac.c
+++ b/drivers/net/ethernet/microchip/lan966x/lan966x_mac.c
@@ -346,7 +346,7 @@ static void lan966x_mac_irq_process(struct lan966x *lan966x, u32 row,
 
                        lan966x_mac_process_raw_entry(&raw_entries[column],
                                                      mac, &vid, &dest_idx);
-                       if (WARN_ON(dest_idx > lan966x->num_phys_ports))
+                       if (WARN_ON(dest_idx >= lan966x->num_phys_ports))
                                continue;
 
                        /* If the entry in SW is found, then there is nothing
@@ -393,7 +393,7 @@ static void lan966x_mac_irq_process(struct lan966x *lan966x, u32 row,
 
                lan966x_mac_process_raw_entry(&raw_entries[column],
                                              mac, &vid, &dest_idx);
-               if (WARN_ON(dest_idx > lan966x->num_phys_ports))
+               if (WARN_ON(dest_idx >= lan966x->num_phys_ports))
                        continue;
 
                mac_entry = lan966x_mac_alloc_entry(mac, vid, dest_idx);