[PATCH v2 1/2] firewire: Fix out-of-bounds access in CSR iterator

[Sreeraj S Kurup]

The fw_csr_iterator_next() function reads ci->p before
checking if it has reached the end.

This can cause an out-of-bounds read when the iterator
has no more entries.

Check the iterator position before reading the entry.
Move the pointer forward only after reading a valid entry.

Signed-off-by: Sreeraj S Kurup <sreekuttan2156239@xxxxxxxxx>
---
 drivers/firewire/core-device.c | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/drivers/firewire/core-device.c b/drivers/firewire/core-device.c
index a68100d3da0b..36667841ca3c 100644
--- a/drivers/firewire/core-device.c
+++ b/drivers/firewire/core-device.c
@@ -40,10 +40,14 @@ EXPORT_SYMBOL(fw_csr_iterator_init);
 
 int fw_csr_iterator_next(struct fw_csr_iterator *ci, int *key, int *value)
 {
+	if (ci->p >= ci->end)
+		return 0;
+
 	*key = *ci->p >> 24;
 	*value = *ci->p & 0xffffff;
 
-	return ci->p++ < ci->end;
+	ci->p++;
+	return 1;
 }
 EXPORT_SYMBOL(fw_csr_iterator_next);
 
-- 
2.55.0