| Message ID | 20240819235251.1331763-1-Joseph.Huang@garmin.com (mailing list archive) |
|---|---|
| State | Accepted |
| Commit | 528876d867a23b5198022baf2e388052ca67c952 |
| Delegated to: | Netdev Maintainers |
| Headers | show |
| Series | [v2,net,1/1] net: dsa: mv88e6xxx: Fix out-of-bound access | expand |
On Mon, Aug 19, 2024 at 07:52:50PM -0400, Joseph Huang wrote: > If an ATU violation was caused by a CPU Load operation, the SPID could > be larger than DSA_MAX_PORTS (the size of mv88e6xxx_chip.ports[] array). > > Fixes: 75c05a74e745 ("net: dsa: mv88e6xxx: Fix counting of ATU violations") > Signed-off-by: Joseph Huang <Joseph.Huang@garmin.com> Reviewed-by: Andrew Lunn <andrew@lunn.ch> Andrew
Hello: This patch was applied to netdev/net.git (main) by Jakub Kicinski <kuba@kernel.org>: On Mon, 19 Aug 2024 19:52:50 -0400 you wrote: > If an ATU violation was caused by a CPU Load operation, the SPID could > be larger than DSA_MAX_PORTS (the size of mv88e6xxx_chip.ports[] array). > > Fixes: 75c05a74e745 ("net: dsa: mv88e6xxx: Fix counting of ATU violations") > Signed-off-by: Joseph Huang <Joseph.Huang@garmin.com> > --- > v1: https://lore.kernel.org/lkml/20240819222641.1292308-1-Joseph.Huang@garmin.com/ > v2: Use ARRAY_SIZE instead of hard-coded SPID value. > > [...] Here is the summary with links: - [v2,net,1/1] net: dsa: mv88e6xxx: Fix out-of-bound access https://git.kernel.org/netdev/net/c/528876d867a2 You are awesome, thank you!
diff --git a/drivers/net/dsa/mv88e6xxx/global1_atu.c b/drivers/net/dsa/mv88e6xxx/global1_atu.c index ce3b3690c3c0..c47f068f56b3 100644 --- a/drivers/net/dsa/mv88e6xxx/global1_atu.c +++ b/drivers/net/dsa/mv88e6xxx/global1_atu.c @@ -457,7 +457,8 @@ static irqreturn_t mv88e6xxx_g1_atu_prob_irq_thread_fn(int irq, void *dev_id) trace_mv88e6xxx_atu_full_violation(chip->dev, spid, entry.portvec, entry.mac, fid); - chip->ports[spid].atu_full_violation++; + if (spid < ARRAY_SIZE(chip->ports)) + chip->ports[spid].atu_full_violation++; } return IRQ_HANDLED;
If an ATU violation was caused by a CPU Load operation, the SPID could be larger than DSA_MAX_PORTS (the size of mv88e6xxx_chip.ports[] array). Fixes: 75c05a74e745 ("net: dsa: mv88e6xxx: Fix counting of ATU violations") Signed-off-by: Joseph Huang <Joseph.Huang@garmin.com> --- v1: https://lore.kernel.org/lkml/20240819222641.1292308-1-Joseph.Huang@garmin.com/ v2: Use ARRAY_SIZE instead of hard-coded SPID value. --- drivers/net/dsa/mv88e6xxx/global1_atu.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)