net: sched: sch: Fix off by one in htb_activate_prios()

The > needs be >= to prevent an out of bounds access.

Fixes: de5ca4c3852f ("net: sched: sch: Bounds check priority")
Signed-off-by: Dan Carpenter <error27@gmail.com>
Reviewed-by: Simon Horman <simon.horman@corigine.com>
Reviewed-by: Kees Cook <keescook@chromium.org>
Link: https://lore.kernel.org/r/Y+D+KN18FQI2DKLq@kili
Signed-off-by: Jakub Kicinski <kuba@kernel.org>

diff --git a/net/sched/sch_htb.c b/net/sched/sch_htb.c
index cc28e41fb745c0fb23289de413264211912968c7..92f2975b6a827760df1565520bd766b3066c4c7d 100644 (file)
--- a/net/sched/sch_htb.c
+++ b/net/sched/sch_htb.c
@@ -433,7 +433,7 @@ static void htb_activate_prios(struct htb_sched *q, struct htb_class *cl)
                while (m) {
                        unsigned int prio = ffz(~m);
 
-                       if (WARN_ON_ONCE(prio > ARRAY_SIZE(p->inner.clprio)))
+                       if (WARN_ON_ONCE(prio >= ARRAY_SIZE(p->inner.clprio)))
                                break;
                        m &= ~(1 << prio);