Commit bd50c412 authored by Aleksandr Mishin's avatar Aleksandr Mishin Committed by Jakub Kicinski
Browse files

fsl/fman: Validate cell-index value obtained from Device Tree 



Cell-index value is obtained from Device Tree and then used to calculate
the index for accessing arrays port_mfl[], mac_mfl[] and intr_mng[].
In case of broken DT due to any error cell-index can contain any value
and it is possible to go beyond the array boundaries which can lead
at least to memory corruption.

Validate cell-index value obtained from Device Tree.

Found by Linux Verification Center (linuxtesting.org) with SVACE.

Reviewed-by: default avatarSean Anderson <sean.anderson@seco.com>
Signed-off-by: default avatarAleksandr Mishin <amishin@t-argos.ru>
Link: https://patch.msgid.link/20241028065824.15452-1-amishin@t-argos.ru


Signed-off-by: default avatarJakub Kicinski <kuba@kernel.org>
parent d86c7a91

drivers/net/ethernet/freescale/fman/fman.c

+0 −1
Original line number Diff line number Diff line
@@ -24,7 +24,6 @@ 


/* General defines */

#define FMAN_LIODN_TBL			64	/* size of LIODN table */

#define MAX_NUM_OF_MACS			10

#define FM_NUM_OF_FMAN_CTRL_EVENT_REGS	4

#define BASE_RX_PORTID			0x08

#define BASE_TX_PORTID			0x28

drivers/net/ethernet/freescale/fman/fman.h

+3 −0
Original line number Diff line number Diff line
@@ -74,6 +74,9 @@ 
#define BM_MAX_NUM_OF_POOLS		64 /* Buffers pools */

#define FMAN_PORT_MAX_EXT_POOLS_NUM	8  /* External BM pools per Rx port */



/* General defines */

#define MAX_NUM_OF_MACS			10



struct fman; /* FMan data */



/* Enum for defining port types */

drivers/net/ethernet/freescale/fman/mac.c

+5 −0
Original line number Diff line number Diff line
@@ -217,6 +217,11 @@ static int mac_probe(struct platform_device *_of_dev) 
		err = -EINVAL;

		goto _return_dev_put;

	}

	if (val >= MAX_NUM_OF_MACS) {

		dev_err(dev, "cell-index value is too big for %pOF\n", mac_node);

		err = -EINVAL;

		goto _return_dev_put;

	}

	priv->cell_index = (u8)val;



	/* Get the MAC address */