tjh.dev / kernel
Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux
1
fork

Configure Feed

Select the types of activity you want to include in your feed.

eth: fbnic: fix ubsan complaints about OOB accesses

UBSAN complains that we reach beyond the end of the log entry:

UBSAN: array-index-out-of-bounds in drivers/net/ethernet/meta/fbnic/fbnic_fw_log.c:94:50
index 71 is out of range for type 'char [*]'
Call Trace:
<TASK>
ubsan_epilogue+0x5/0x2b
fbnic_fw_log_write+0x120/0x960
fbnic_fw_parse_logs+0x161/0x210

We're just taking the address of the character after the array,
so this really seems like something that should be legal.
But whatever, easy enough to silence by doing direct pointer math.

Fixes: c2b93d6beca8 ("eth: fbnic: Create ring buffer for firmware logs")
Reviewed-by: Alexander Duyck <alexanderduyck@fb.com>
Reviewed-by: Jacob Keller <jacob.e.keller@intel.com>
Link: https://patch.msgid.link/20250709205910.3107691-1-kuba@kernel.org
Signed-off-by: Jakub Kicinski <kuba@kernel.org>

Jakub Kicinski 0346000a 2f82e995

+4 -4
+4 -4
drivers/net/ethernet/meta/fbnic/fbnic_fw_log.c
··· 91 91 entry = log->data_start; 92 92 } else { 93 93 head = list_first_entry(&log->entries, typeof(*head), list); 94 - entry = (struct fbnic_fw_log_entry *)&head->msg[head->len + 1]; 95 - entry = PTR_ALIGN(entry, 8); 94 + entry_end = head->msg + head->len + 1; 95 + entry = PTR_ALIGN(entry_end, 8); 96 96 } 97 97 98 - entry_end = &entry->msg[msg_len + 1]; 98 + entry_end = entry->msg + msg_len + 1; 99 99 100 100 /* We've reached the end of the buffer, wrap around */ 101 101 if (entry_end > log->data_end) { 102 102 entry = log->data_start; 103 - entry_end = &entry->msg[msg_len + 1]; 103 + entry_end = entry->msg + msg_len + 1; 104 104 } 105 105 106 106 /* Make room for entry by removing from tail. */