Commit 837ec05c authored by Danielle Ratson's avatar Danielle Ratson Committed by David S. Miller
Browse files

mlxsw: Verify the accessed index doesn't exceed the array length 



There are few cases in which an array index queried from a fw register,
is accessed without any validation that it doesn't exceed the array
length.

Add a proper length validation, so accessing memory past the end of an
array will be forbidden.

Signed-off-by: default avatarDanielle Ratson <danieller@nvidia.com>
Signed-off-by: default avatarIdo Schimmel <idosch@nvidia.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent ece5df87

drivers/net/ethernet/mellanox/mlxsw/minimal.c

+4 −0
Original line number Diff line number Diff line
@@ -234,6 +234,7 @@ static void mlxsw_m_port_remove(struct mlxsw_m *mlxsw_m, u8 local_port) 
static int mlxsw_m_port_module_map(struct mlxsw_m *mlxsw_m, u8 local_port,

				   u8 *last_module)

{

	unsigned int max_ports = mlxsw_core_max_ports(mlxsw_m->core);

	u8 module, width;

	int err;
@@ -249,6 +250,9 @@ static int mlxsw_m_port_module_map(struct mlxsw_m *mlxsw_m, u8 local_port, 
	if (module == *last_module)

		return 0;

	*last_module = module;



	if (WARN_ON_ONCE(module >= max_ports))

		return -EINVAL;

	mlxsw_m->module_to_port[module] = ++mlxsw_m->max_ports;



	return 0;

drivers/net/ethernet/mellanox/mlxsw/spectrum.c

+5 −0
Original line number Diff line number Diff line
@@ -2125,9 +2125,14 @@ static void mlxsw_sp_pude_event_func(const struct mlxsw_reg_info *reg, 
	struct mlxsw_sp *mlxsw_sp = priv;

	struct mlxsw_sp_port *mlxsw_sp_port;

	enum mlxsw_reg_pude_oper_status status;

	unsigned int max_ports;

	u8 local_port;



	max_ports = mlxsw_core_max_ports(mlxsw_sp->core);

	local_port = mlxsw_reg_pude_local_port_get(pude_pl);



	if (WARN_ON_ONCE(local_port >= max_ports))

		return;

	mlxsw_sp_port = mlxsw_sp->ports[local_port];

	if (!mlxsw_sp_port)

		return;

drivers/net/ethernet/mellanox/mlxsw/spectrum_ptp.c

+3 −0
Original line number Diff line number Diff line
@@ -568,10 +568,13 @@ void mlxsw_sp1_ptp_got_timestamp(struct mlxsw_sp *mlxsw_sp, bool ingress, 
				 u8 domain_number, u16 sequence_id,

				 u64 timestamp)

{

	unsigned int max_ports = mlxsw_core_max_ports(mlxsw_sp->core);

	struct mlxsw_sp_port *mlxsw_sp_port;

	struct mlxsw_sp1_ptp_key key;

	u8 types;



	if (WARN_ON_ONCE(local_port >= max_ports))

		return;

	mlxsw_sp_port = mlxsw_sp->ports[local_port];

	if (!mlxsw_sp_port)

		return;

drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c

+3 −0
Original line number Diff line number Diff line
@@ -2282,6 +2282,7 @@ static void mlxsw_sp_router_neigh_ent_ipv4_process(struct mlxsw_sp *mlxsw_sp, 
						   char *rauhtd_pl,

						   int ent_index)

{

	u64 max_rifs = MLXSW_CORE_RES_GET(mlxsw_sp->core, MAX_RIFS);

	struct net_device *dev;

	struct neighbour *n;

	__be32 dipn;
@@ -2290,6 +2291,8 @@ static void mlxsw_sp_router_neigh_ent_ipv4_process(struct mlxsw_sp *mlxsw_sp, 


	mlxsw_reg_rauhtd_ent_ipv4_unpack(rauhtd_pl, ent_index, &rif, &dip);



	if (WARN_ON_ONCE(rif >= max_rifs))

		return;

	if (!mlxsw_sp->router->rifs[rif]) {

		dev_err_ratelimited(mlxsw_sp->bus_info->dev, "Incorrect RIF in neighbour entry\n");

		return;

drivers/net/ethernet/mellanox/mlxsw/spectrum_switchdev.c

+4 −0
Original line number Diff line number Diff line
@@ -2520,6 +2520,7 @@ static void mlxsw_sp_fdb_notify_mac_process(struct mlxsw_sp *mlxsw_sp, 
					    char *sfn_pl, int rec_index,

					    bool adding)

{

	unsigned int max_ports = mlxsw_core_max_ports(mlxsw_sp->core);

	struct mlxsw_sp_port_vlan *mlxsw_sp_port_vlan;

	struct mlxsw_sp_bridge_device *bridge_device;

	struct mlxsw_sp_bridge_port *bridge_port;
@@ -2532,6 +2533,9 @@ static void mlxsw_sp_fdb_notify_mac_process(struct mlxsw_sp *mlxsw_sp, 
	int err;



	mlxsw_reg_sfn_mac_unpack(sfn_pl, rec_index, mac, &fid, &local_port);



	if (WARN_ON_ONCE(local_port >= max_ports))

		return;

	mlxsw_sp_port = mlxsw_sp->ports[local_port];

	if (!mlxsw_sp_port) {

		dev_err_ratelimited(mlxsw_sp->bus_info->dev, "Incorrect local port in FDB notification\n");