patches/kernel/0014-net-atlantic-Avoid-out-of-bounds-indexing.patch

   1 From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
   2 From: Kai-Heng Feng <kai.heng.feng@canonical.com>
   3 Date: Fri, 8 Apr 2022 10:22:04 +0800
   4 Subject: [PATCH] net: atlantic: Avoid out-of-bounds indexing
   5
   6 [ Upstream commit 8d3a6c37d50d5a0504c126c932cc749e6dd9c78f ]
   7
   8 UBSAN warnings are observed on atlantic driver:
   9 [ 294.432996] UBSAN: array-index-out-of-bounds in /build/linux-Qow4fL/linux-5.15.0/drivers/net/ethernet/aquantia/atlantic/aq_nic.c:484:48
  10 [ 294.433695] index 8 is out of range for type 'aq_vec_s *[8]'
  11
  12 The ring is dereferenced right before breaking out the loop, to prevent
  13 that from happening, only use the index in the loop to fix the issue.
  14
  15 BugLink: https://bugs.launchpad.net/bugs/1958770
  16 Tested-by: Mario Limonciello <mario.limonciello@amd.com>
  17 Signed-off-by: Kai-Heng Feng <kai.heng.feng@canonical.com>
  18 Reviewed-by: Igor Russkikh <irusskikh@marvell.com>
  19 Link: https://lore.kernel.org/r/20220408022204.16815-1-kai.heng.feng@canonical.com
  20 Signed-off-by: Jakub Kicinski <kuba@kernel.org>
  21 Signed-off-by: Sasha Levin <sashal@kernel.org>
  22 Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
  23 ---
  24  .../net/ethernet/aquantia/atlantic/aq_nic.c   |  8 +++----
  25  .../net/ethernet/aquantia/atlantic/aq_vec.c   | 24 +++++++++----------
  26  2 files changed, 16 insertions(+), 16 deletions(-)
  27
  28 diff --git a/drivers/net/ethernet/aquantia/atlantic/aq_nic.c b/drivers/net/ethernet/aquantia/atlantic/aq_nic.c
  29 index 9de0065f89b9..fbb1e05d5878 100644
  30 --- a/drivers/net/ethernet/aquantia/atlantic/aq_nic.c
  31 +++ b/drivers/net/ethernet/aquantia/atlantic/aq_nic.c
  32 @@ -480,8 +480,8 @@ int aq_nic_start(struct aq_nic_s *self)
  33         if (err < 0)
  34                 goto err_exit;
  35
  36 -       for (i = 0U, aq_vec = self->aq_vec[0];
  37 -               self->aq_vecs > i; ++i, aq_vec = self->aq_vec[i]) {
  38 +       for (i = 0U; self->aq_vecs > i; ++i) {
  39 +               aq_vec = self->aq_vec[i];
  40                 err = aq_vec_start(aq_vec);
  41                 if (err < 0)
  42                         goto err_exit;
  43 @@ -511,8 +511,8 @@ int aq_nic_start(struct aq_nic_s *self)
  44                 mod_timer(&self->polling_timer, jiffies +
  45                           AQ_CFG_POLLING_TIMER_INTERVAL);
  46         } else {
  47 -               for (i = 0U, aq_vec = self->aq_vec[0];
  48 -                       self->aq_vecs > i; ++i, aq_vec = self->aq_vec[i]) {
  49 +               for (i = 0U; self->aq_vecs > i; ++i) {
  50 +                       aq_vec = self->aq_vec[i];
  51                         err = aq_pci_func_alloc_irq(self, i, self->ndev->name,
  52                                                     aq_vec_isr, aq_vec,
  53                                                     aq_vec_get_affinity_mask(aq_vec));
  54 diff --git a/drivers/net/ethernet/aquantia/atlantic/aq_vec.c b/drivers/net/ethernet/aquantia/atlantic/aq_vec.c
  55 index f4774cf051c9..6ab1f3212d24 100644
  56 --- a/drivers/net/ethernet/aquantia/atlantic/aq_vec.c
  57 +++ b/drivers/net/ethernet/aquantia/atlantic/aq_vec.c
  58 @@ -43,8 +43,8 @@ static int aq_vec_poll(struct napi_struct *napi, int budget)
  59         if (!self) {
  60                 err = -EINVAL;
  61         } else {
  62 -               for (i = 0U, ring = self->ring[0];
  63 -                       self->tx_rings > i; ++i, ring = self->ring[i]) {
  64 +               for (i = 0U; self->tx_rings > i; ++i) {
  65 +                       ring = self->ring[i];
  66                         u64_stats_update_begin(&ring[AQ_VEC_RX_ID].stats.rx.syncp);
  67                         ring[AQ_VEC_RX_ID].stats.rx.polls++;
  68                         u64_stats_update_end(&ring[AQ_VEC_RX_ID].stats.rx.syncp);
  69 @@ -182,8 +182,8 @@ int aq_vec_init(struct aq_vec_s *self, const struct aq_hw_ops *aq_hw_ops,
  70         self->aq_hw_ops = aq_hw_ops;
  71         self->aq_hw = aq_hw;
  72
  73 -       for (i = 0U, ring = self->ring[0];
  74 -               self->tx_rings > i; ++i, ring = self->ring[i]) {
  75 +       for (i = 0U; self->tx_rings > i; ++i) {
  76 +               ring = self->ring[i];
  77                 err = aq_ring_init(&ring[AQ_VEC_TX_ID], ATL_RING_TX);
  78                 if (err < 0)
  79                         goto err_exit;
  80 @@ -224,8 +224,8 @@ int aq_vec_start(struct aq_vec_s *self)
  81         unsigned int i = 0U;
  82         int err = 0;
  83
  84 -       for (i = 0U, ring = self->ring[0];
  85 -               self->tx_rings > i; ++i, ring = self->ring[i]) {
  86 +       for (i = 0U; self->tx_rings > i; ++i) {
  87 +               ring = self->ring[i];
  88                 err = self->aq_hw_ops->hw_ring_tx_start(self->aq_hw,
  89                                                         &ring[AQ_VEC_TX_ID]);
  90                 if (err < 0)
  91 @@ -248,8 +248,8 @@ void aq_vec_stop(struct aq_vec_s *self)
  92         struct aq_ring_s *ring = NULL;
  93         unsigned int i = 0U;
  94
  95 -       for (i = 0U, ring = self->ring[0];
  96 -               self->tx_rings > i; ++i, ring = self->ring[i]) {
  97 +       for (i = 0U; self->tx_rings > i; ++i) {
  98 +               ring = self->ring[i];
  99                 self->aq_hw_ops->hw_ring_tx_stop(self->aq_hw,
 100                                                  &ring[AQ_VEC_TX_ID]);
 101
 102 @@ -268,8 +268,8 @@ void aq_vec_deinit(struct aq_vec_s *self)
 103         if (!self)
 104                 goto err_exit;
 105
 106 -       for (i = 0U, ring = self->ring[0];
 107 -               self->tx_rings > i; ++i, ring = self->ring[i]) {
 108 +       for (i = 0U; self->tx_rings > i; ++i) {
 109 +               ring = self->ring[i];
 110                 aq_ring_tx_clean(&ring[AQ_VEC_TX_ID]);
 111                 aq_ring_rx_deinit(&ring[AQ_VEC_RX_ID]);
 112         }
 113 @@ -297,8 +297,8 @@ void aq_vec_ring_free(struct aq_vec_s *self)
 114         if (!self)
 115                 goto err_exit;
 116
 117 -       for (i = 0U, ring = self->ring[0];
 118 -               self->tx_rings > i; ++i, ring = self->ring[i]) {
 119 +       for (i = 0U; self->tx_rings > i; ++i) {
 120 +               ring = self->ring[i];
 121                 aq_ring_free(&ring[AQ_VEC_TX_ID]);
 122                 if (i < self->rx_rings)
 123                         aq_ring_free(&ring[AQ_VEC_RX_ID]);