lkml.org 
[lkml]   [2022]   [Apr]   [26]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 5.15 062/124] net: atlantic: Avoid out-of-bounds indexing
    Date
    From: Kai-Heng Feng <kai.heng.feng@canonical.com>

    [ Upstream commit 8d3a6c37d50d5a0504c126c932cc749e6dd9c78f ]

    UBSAN warnings are observed on atlantic driver:
    [ 294.432996] UBSAN: array-index-out-of-bounds in /build/linux-Qow4fL/linux-5.15.0/drivers/net/ethernet/aquantia/atlantic/aq_nic.c:484:48
    [ 294.433695] index 8 is out of range for type 'aq_vec_s *[8]'

    The ring is dereferenced right before breaking out the loop, to prevent
    that from happening, only use the index in the loop to fix the issue.

    BugLink: https://bugs.launchpad.net/bugs/1958770
    Tested-by: Mario Limonciello <mario.limonciello@amd.com>
    Signed-off-by: Kai-Heng Feng <kai.heng.feng@canonical.com>
    Reviewed-by: Igor Russkikh <irusskikh@marvell.com>
    Link: https://lore.kernel.org/r/20220408022204.16815-1-kai.heng.feng@canonical.com
    Signed-off-by: Jakub Kicinski <kuba@kernel.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>
    ---
    .../net/ethernet/aquantia/atlantic/aq_nic.c | 8 +++----
    .../net/ethernet/aquantia/atlantic/aq_vec.c | 24 +++++++++----------
    2 files changed, 16 insertions(+), 16 deletions(-)

    diff --git a/drivers/net/ethernet/aquantia/atlantic/aq_nic.c b/drivers/net/ethernet/aquantia/atlantic/aq_nic.c
    index 9de0065f89b9..fbb1e05d5878 100644
    --- a/drivers/net/ethernet/aquantia/atlantic/aq_nic.c
    +++ b/drivers/net/ethernet/aquantia/atlantic/aq_nic.c
    @@ -480,8 +480,8 @@ int aq_nic_start(struct aq_nic_s *self)
    if (err < 0)
    goto err_exit;

    - for (i = 0U, aq_vec = self->aq_vec[0];
    - self->aq_vecs > i; ++i, aq_vec = self->aq_vec[i]) {
    + for (i = 0U; self->aq_vecs > i; ++i) {
    + aq_vec = self->aq_vec[i];
    err = aq_vec_start(aq_vec);
    if (err < 0)
    goto err_exit;
    @@ -511,8 +511,8 @@ int aq_nic_start(struct aq_nic_s *self)
    mod_timer(&self->polling_timer, jiffies +
    AQ_CFG_POLLING_TIMER_INTERVAL);
    } else {
    - for (i = 0U, aq_vec = self->aq_vec[0];
    - self->aq_vecs > i; ++i, aq_vec = self->aq_vec[i]) {
    + for (i = 0U; self->aq_vecs > i; ++i) {
    + aq_vec = self->aq_vec[i];
    err = aq_pci_func_alloc_irq(self, i, self->ndev->name,
    aq_vec_isr, aq_vec,
    aq_vec_get_affinity_mask(aq_vec));
    diff --git a/drivers/net/ethernet/aquantia/atlantic/aq_vec.c b/drivers/net/ethernet/aquantia/atlantic/aq_vec.c
    index f4774cf051c9..6ab1f3212d24 100644
    --- a/drivers/net/ethernet/aquantia/atlantic/aq_vec.c
    +++ b/drivers/net/ethernet/aquantia/atlantic/aq_vec.c
    @@ -43,8 +43,8 @@ static int aq_vec_poll(struct napi_struct *napi, int budget)
    if (!self) {
    err = -EINVAL;
    } else {
    - for (i = 0U, ring = self->ring[0];
    - self->tx_rings > i; ++i, ring = self->ring[i]) {
    + for (i = 0U; self->tx_rings > i; ++i) {
    + ring = self->ring[i];
    u64_stats_update_begin(&ring[AQ_VEC_RX_ID].stats.rx.syncp);
    ring[AQ_VEC_RX_ID].stats.rx.polls++;
    u64_stats_update_end(&ring[AQ_VEC_RX_ID].stats.rx.syncp);
    @@ -182,8 +182,8 @@ int aq_vec_init(struct aq_vec_s *self, const struct aq_hw_ops *aq_hw_ops,
    self->aq_hw_ops = aq_hw_ops;
    self->aq_hw = aq_hw;

    - for (i = 0U, ring = self->ring[0];
    - self->tx_rings > i; ++i, ring = self->ring[i]) {
    + for (i = 0U; self->tx_rings > i; ++i) {
    + ring = self->ring[i];
    err = aq_ring_init(&ring[AQ_VEC_TX_ID], ATL_RING_TX);
    if (err < 0)
    goto err_exit;
    @@ -224,8 +224,8 @@ int aq_vec_start(struct aq_vec_s *self)
    unsigned int i = 0U;
    int err = 0;

    - for (i = 0U, ring = self->ring[0];
    - self->tx_rings > i; ++i, ring = self->ring[i]) {
    + for (i = 0U; self->tx_rings > i; ++i) {
    + ring = self->ring[i];
    err = self->aq_hw_ops->hw_ring_tx_start(self->aq_hw,
    &ring[AQ_VEC_TX_ID]);
    if (err < 0)
    @@ -248,8 +248,8 @@ void aq_vec_stop(struct aq_vec_s *self)
    struct aq_ring_s *ring = NULL;
    unsigned int i = 0U;

    - for (i = 0U, ring = self->ring[0];
    - self->tx_rings > i; ++i, ring = self->ring[i]) {
    + for (i = 0U; self->tx_rings > i; ++i) {
    + ring = self->ring[i];
    self->aq_hw_ops->hw_ring_tx_stop(self->aq_hw,
    &ring[AQ_VEC_TX_ID]);

    @@ -268,8 +268,8 @@ void aq_vec_deinit(struct aq_vec_s *self)
    if (!self)
    goto err_exit;

    - for (i = 0U, ring = self->ring[0];
    - self->tx_rings > i; ++i, ring = self->ring[i]) {
    + for (i = 0U; self->tx_rings > i; ++i) {
    + ring = self->ring[i];
    aq_ring_tx_clean(&ring[AQ_VEC_TX_ID]);
    aq_ring_rx_deinit(&ring[AQ_VEC_RX_ID]);
    }
    @@ -297,8 +297,8 @@ void aq_vec_ring_free(struct aq_vec_s *self)
    if (!self)
    goto err_exit;

    - for (i = 0U, ring = self->ring[0];
    - self->tx_rings > i; ++i, ring = self->ring[i]) {
    + for (i = 0U; self->tx_rings > i; ++i) {
    + ring = self->ring[i];
    aq_ring_free(&ring[AQ_VEC_TX_ID]);
    if (i < self->rx_rings)
    aq_ring_free(&ring[AQ_VEC_RX_ID]);
    --
    2.35.1


    \
     
     \ /
      Last update: 2022-04-26 11:13    [W:3.865 / U:0.028 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site