1 From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
2 From: Kai-Heng Feng <kai.heng.feng@canonical.com>
3 Date: Fri, 8 Apr 2022 10:22:04 +0800
4 Subject: [PATCH] net: atlantic: Avoid out-of-bounds indexing
6 [ Upstream commit 8d3a6c37d50d5a0504c126c932cc749e6dd9c78f ]
8 UBSAN warnings are observed on atlantic driver:
9 [ 294.432996] UBSAN: array-index-out-of-bounds in /build/linux-Qow4fL/linux-5.15.0/drivers/net/ethernet/aquantia/atlantic/aq_nic.c:484:48
10 [ 294.433695] index 8 is out of range for type 'aq_vec_s *[8]'
12 The ring is dereferenced right before breaking out the loop, to prevent
13 that from happening, only use the index in the loop to fix the issue.
15 BugLink: https://bugs.launchpad.net/bugs/1958770
16 Tested-by: Mario Limonciello <mario.limonciello@amd.com>
17 Signed-off-by: Kai-Heng Feng <kai.heng.feng@canonical.com>
18 Reviewed-by: Igor Russkikh <irusskikh@marvell.com>
19 Link: https://lore.kernel.org/r/20220408022204.16815-1-kai.heng.feng@canonical.com
20 Signed-off-by: Jakub Kicinski <kuba@kernel.org>
21 Signed-off-by: Sasha Levin <sashal@kernel.org>
22 Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
24 .../net/ethernet/aquantia/atlantic/aq_nic.c | 8 +++----
25 .../net/ethernet/aquantia/atlantic/aq_vec.c | 24 +++++++++----------
26 2 files changed, 16 insertions(+), 16 deletions(-)
28 diff --git a/drivers/net/ethernet/aquantia/atlantic/aq_nic.c b/drivers/net/ethernet/aquantia/atlantic/aq_nic.c
29 index 9de0065f89b9..fbb1e05d5878 100644
30 --- a/drivers/net/ethernet/aquantia/atlantic/aq_nic.c
31 +++ b/drivers/net/ethernet/aquantia/atlantic/aq_nic.c
32 @@ -480,8 +480,8 @@ int aq_nic_start(struct aq_nic_s *self)
36 - for (i = 0U, aq_vec = self->aq_vec[0];
37 - self->aq_vecs > i; ++i, aq_vec = self->aq_vec[i]) {
38 + for (i = 0U; self->aq_vecs > i; ++i) {
39 + aq_vec = self->aq_vec[i];
40 err = aq_vec_start(aq_vec);
43 @@ -511,8 +511,8 @@ int aq_nic_start(struct aq_nic_s *self)
44 mod_timer(&self->polling_timer, jiffies +
45 AQ_CFG_POLLING_TIMER_INTERVAL);
47 - for (i = 0U, aq_vec = self->aq_vec[0];
48 - self->aq_vecs > i; ++i, aq_vec = self->aq_vec[i]) {
49 + for (i = 0U; self->aq_vecs > i; ++i) {
50 + aq_vec = self->aq_vec[i];
51 err = aq_pci_func_alloc_irq(self, i, self->ndev->name,
53 aq_vec_get_affinity_mask(aq_vec));
54 diff --git a/drivers/net/ethernet/aquantia/atlantic/aq_vec.c b/drivers/net/ethernet/aquantia/atlantic/aq_vec.c
55 index f4774cf051c9..6ab1f3212d24 100644
56 --- a/drivers/net/ethernet/aquantia/atlantic/aq_vec.c
57 +++ b/drivers/net/ethernet/aquantia/atlantic/aq_vec.c
58 @@ -43,8 +43,8 @@ static int aq_vec_poll(struct napi_struct *napi, int budget)
62 - for (i = 0U, ring = self->ring[0];
63 - self->tx_rings > i; ++i, ring = self->ring[i]) {
64 + for (i = 0U; self->tx_rings > i; ++i) {
65 + ring = self->ring[i];
66 u64_stats_update_begin(&ring[AQ_VEC_RX_ID].stats.rx.syncp);
67 ring[AQ_VEC_RX_ID].stats.rx.polls++;
68 u64_stats_update_end(&ring[AQ_VEC_RX_ID].stats.rx.syncp);
69 @@ -182,8 +182,8 @@ int aq_vec_init(struct aq_vec_s *self, const struct aq_hw_ops *aq_hw_ops,
70 self->aq_hw_ops = aq_hw_ops;
73 - for (i = 0U, ring = self->ring[0];
74 - self->tx_rings > i; ++i, ring = self->ring[i]) {
75 + for (i = 0U; self->tx_rings > i; ++i) {
76 + ring = self->ring[i];
77 err = aq_ring_init(&ring[AQ_VEC_TX_ID], ATL_RING_TX);
80 @@ -224,8 +224,8 @@ int aq_vec_start(struct aq_vec_s *self)
84 - for (i = 0U, ring = self->ring[0];
85 - self->tx_rings > i; ++i, ring = self->ring[i]) {
86 + for (i = 0U; self->tx_rings > i; ++i) {
87 + ring = self->ring[i];
88 err = self->aq_hw_ops->hw_ring_tx_start(self->aq_hw,
91 @@ -248,8 +248,8 @@ void aq_vec_stop(struct aq_vec_s *self)
92 struct aq_ring_s *ring = NULL;
95 - for (i = 0U, ring = self->ring[0];
96 - self->tx_rings > i; ++i, ring = self->ring[i]) {
97 + for (i = 0U; self->tx_rings > i; ++i) {
98 + ring = self->ring[i];
99 self->aq_hw_ops->hw_ring_tx_stop(self->aq_hw,
100 &ring[AQ_VEC_TX_ID]);
102 @@ -268,8 +268,8 @@ void aq_vec_deinit(struct aq_vec_s *self)
106 - for (i = 0U, ring = self->ring[0];
107 - self->tx_rings > i; ++i, ring = self->ring[i]) {
108 + for (i = 0U; self->tx_rings > i; ++i) {
109 + ring = self->ring[i];
110 aq_ring_tx_clean(&ring[AQ_VEC_TX_ID]);
111 aq_ring_rx_deinit(&ring[AQ_VEC_RX_ID]);
113 @@ -297,8 +297,8 @@ void aq_vec_ring_free(struct aq_vec_s *self)
117 - for (i = 0U, ring = self->ring[0];
118 - self->tx_rings > i; ++i, ring = self->ring[i]) {
119 + for (i = 0U; self->tx_rings > i; ++i) {
120 + ring = self->ring[i];
121 aq_ring_free(&ring[AQ_VEC_TX_ID]);
122 if (i < self->rx_rings)
123 aq_ring_free(&ring[AQ_VEC_RX_ID]);