netdev - Re: [PATCH] tg3: fix array subscript out of bounds compilation error

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Mon, 17 Jul 2023 12:24:03 -0700
From: Kuniyuki Iwashima <kuniyu@...zon.com>
To: <carlos.bilbao@....com>
CC: <davem@...emloft.net>, <edumazet@...gle.com>, <kuba@...nel.org>,
	<linux-kernel@...r.kernel.org>, <mchan@...adcom.com>,
	<netdev@...r.kernel.org>, <pabeni@...hat.com>, <prashant@...adcom.com>,
	<siva.kallam@...adcom.com>, <kuniyu@...zon.com>
Subject: Re: [PATCH] tg3: fix array subscript out of bounds compilation error

From: Carlos Bilbao <carlos.bilbao@....com>
Date: Mon, 17 Jul 2023 09:34:43 -0500
> Fix encountered compilation error in tg3.c where an array subscript was

What is the error ?


> above the array bounds of 'struct tg3_napi[5]'. Add an additional check in
> the for loop to ensure that it does not exceed the bounds of
> 'struct tg3_napi' (defined by TG3_IRQ_MAX_VECS).
> 
> Reviewed-By: Carlos Bilbao <carlos.bilbao@....com>
> ---
>  drivers/net/ethernet/broadcom/tg3.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/drivers/net/ethernet/broadcom/tg3.c b/drivers/net/ethernet/broadcom/tg3.c
> index 4179a12fc881..33ad75b7ed91 100644
> --- a/drivers/net/ethernet/broadcom/tg3.c
> +++ b/drivers/net/ethernet/broadcom/tg3.c
> @@ -17791,7 +17791,7 @@ static int tg3_init_one(struct pci_dev *pdev,
>  	intmbx = MAILBOX_INTERRUPT_0 + TG3_64BIT_REG_LOW;
>  	rcvmbx = MAILBOX_RCVRET_CON_IDX_0 + TG3_64BIT_REG_LOW;
>  	sndmbx = MAILBOX_SNDHOST_PROD_IDX_0 + TG3_64BIT_REG_LOW;
> -	for (i = 0; i < tp->irq_max; i++) {
> +	for (i = 0; i < tp->irq_max && i < TG3_IRQ_MAX_VECS; i++) {

I'm not familiar with this driver, but it seem tg3_init_one() calls
tg3_get_invariants() before the loop and initialises irq_max as 1
or TG3_IRQ_MAX_VECS.

Where does tp->irq_max go over TG3_IRQ_MAX_VECS ?


>  		struct tg3_napi *tnapi = &tp->napi[i];
>  
>  		tnapi->tp = tp;
> -- 
> 2.41.0