From 1cb093c2255d241be8768bb513273ac6fdecf818 Mon Sep 17 00:00:00 2001 From: Dan Carpenter Date: Tue, 11 Mar 2025 08:51:19 +0900 Subject: [PATCH] crypto: qat/qat_4xxx - fix off by one in uof_get_name() BugLink: https://bugs.launchpad.net/bugs/2101915 [ Upstream commit 475b5098043eef6e72751aadeab687992a5b63d1 ] The fw_objs[] array has "num_objs" elements so the > needs to be >= to prevent an out of bounds read. Fixes: 10484c647af6 ("crypto: qat - refactor fw config logic for 4xxx") Signed-off-by: Dan Carpenter Acked-by: Giovanni Cabiddu Signed-off-by: Herbert Xu Signed-off-by: Sasha Levin CVE-2024-53162 Signed-off-by: Koichiro Den Signed-off-by: Stefan Bader --- drivers/crypto/intel/qat/qat_4xxx/adf_4xxx_hw_data.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/crypto/intel/qat/qat_4xxx/adf_4xxx_hw_data.c b/drivers/crypto/intel/qat/qat_4xxx/adf_4xxx_hw_data.c index 7a5c5f9711c8..9c9e72fd28e5 100644 --- a/drivers/crypto/intel/qat/qat_4xxx/adf_4xxx_hw_data.c +++ b/drivers/crypto/intel/qat/qat_4xxx/adf_4xxx_hw_data.c @@ -387,7 +387,7 @@ static const char *uof_get_name(struct adf_accel_dev *accel_dev, u32 obj_num, else id = -EINVAL; - if (id < 0 || id > num_objs) + if (id < 0 || id >= num_objs) return NULL; return fw_objs[id];