tjh.dev / kernel
Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux
1
fork

Configure Feed

Select the types of activity you want to include in your feed.

fsl/fman: Validate cell-index value obtained from Device Tree

Cell-index value is obtained from Device Tree and then used to calculate
the index for accessing arrays port_mfl[], mac_mfl[] and intr_mng[].
In case of broken DT due to any error cell-index can contain any value
and it is possible to go beyond the array boundaries which can lead
at least to memory corruption.

Validate cell-index value obtained from Device Tree.

Found by Linux Verification Center (linuxtesting.org) with SVACE.

Reviewed-by: Sean Anderson <sean.anderson@seco.com>
Signed-off-by: Aleksandr Mishin <amishin@t-argos.ru>
Link: https://patch.msgid.link/20241028065824.15452-1-amishin@t-argos.ru
Signed-off-by: Jakub Kicinski <kuba@kernel.org>

authored by

Aleksandr Mishin and committed by
Jakub Kicinski bd50c412 d86c7a91

+8 -1
-1
drivers/net/ethernet/freescale/fman/fman.c
··· 24 24 25 25 /* General defines */ 26 26 #define FMAN_LIODN_TBL 64 /* size of LIODN table */ 27 - #define MAX_NUM_OF_MACS 10 28 27 #define FM_NUM_OF_FMAN_CTRL_EVENT_REGS 4 29 28 #define BASE_RX_PORTID 0x08 30 29 #define BASE_TX_PORTID 0x28
+3
drivers/net/ethernet/freescale/fman/fman.h
··· 74 74 #define BM_MAX_NUM_OF_POOLS 64 /* Buffers pools */ 75 75 #define FMAN_PORT_MAX_EXT_POOLS_NUM 8 /* External BM pools per Rx port */ 76 76 77 + /* General defines */ 78 + #define MAX_NUM_OF_MACS 10 79 + 77 80 struct fman; /* FMan data */ 78 81 79 82 /* Enum for defining port types */
+5
drivers/net/ethernet/freescale/fman/mac.c
··· 217 217 err = -EINVAL; 218 218 goto _return_dev_put; 219 219 } 220 + if (val >= MAX_NUM_OF_MACS) { 221 + dev_err(dev, "cell-index value is too big for %pOF\n", mac_node); 222 + err = -EINVAL; 223 + goto _return_dev_put; 224 + } 220 225 priv->cell_index = (u8)val; 221 226 222 227 /* Get the MAC address */