diff options
| author |   Petr Machata <petrm@nvidia.com> | 2024-07-08 16:23:40 +0200 |
|---|---|---|
| committer |   Jakub Kicinski <kuba@kernel.org> | 2024-07-09 18:46:44 -0700 |
| commit | b45c76e5f43fa66868e874a42a29bd0288a5ddce (patch) | |
| tree | 70ce3981fdcf2548002086a6d056fbab9d6e3532 | |
| parent | Merge branch 'selftests-drv-net-rss_ctx-more-tests' (diff) | |
| download | wireguard-linux-b45c76e5f43fa66868e874a42a29bd0288a5ddce.tar.xz wireguard-linux-b45c76e5f43fa66868e874a42a29bd0288a5ddce.zip | |
mlxsw: Warn about invalid accesses to array fields
A forgotten or buggy variable initialization can cause out-of-bounds access
to a register or other item array field. For an overflow, such access would
mangle adjacent parts of the register payload. For an underflow, due to all
variables being unsigned, the access would likely trample unrelated memory.
Since neither is correct, replace these accesses with accesses at the index
of 0, and warn about the issue.
Suggested-by: Ido Schimmel <idosch@nvidia.com>
Signed-off-by: Petr Machata <petrm@nvidia.com>
Reviewed-by: Ido Schimmel <idosch@nvidia.com>
Reviewed-by: Przemek Kitszel <przemyslaw.kitszel@intel.com>
Link: https://patch.msgid.link/b988fb265c2f6c1206fe12d5bfdcfa188b7672d1.1720447210.git.petrm@nvidia.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Diffstat (limited to '')
| -rw-r--r-- | drivers/net/ethernet/mellanox/mlxsw/item.h | 4 |
1 files changed, 4 insertions, 0 deletions
diff --git a/drivers/net/ethernet/mellanox/mlxsw/item.h b/drivers/net/ethernet/mellanox/mlxsw/item.h index cfafbeb42586..a619a0736bd1 100644 --- a/drivers/net/ethernet/mellanox/mlxsw/item.h +++ b/drivers/net/ethernet/mellanox/mlxsw/item.h @@ -218,6 +218,10 @@ __mlxsw_item_bit_array_offset(const struct mlxsw_item *item, } max_index = (item->size.bytes << 3) / item->element_size - 1; + if (WARN_ONCE(index > max_index, + "name=%s,index=%u,max_index=%u\n", item->name, index, + max_index)) + index = 0; be_index = max_index - index; offset = be_index * item->element_size >> 3; in_byte_index = index % (BITS_PER_BYTE / item->element_size); |