Commit fe5c5fc1 authored by Jakub Kicinski's avatar Jakub Kicinski
Browse files

net: stmmac: fix out-of-bounds access in a selftest 

GCC 12 points out that struct tc_action is smaller than
struct tcf_action:

drivers/net/ethernet/stmicro/stmmac/stmmac_selftests.c: In function ‘stmmac_test_rxp’:
drivers/net/ethernet/stmicro/stmmac/stmmac_selftests.c:1132:21: warning: array subscript ‘struct tcf_gact[0]’ is partly outside array bounds of ‘unsigned char[272]’ [-Warray-bounds]
 1132 |                 gact->tcf_action = TC_ACT_SHOT;
      |                     ^~

Fixes: ccfc639a ("net: stmmac: selftests: Add a selftest for Flexible RX Parser")
Link: https://lore.kernel.org/r/20220519004305.2109708-1-kuba@kernel.org


Signed-off-by: default avatarJakub Kicinski <kuba@kernel.org>
parent 9b80ccda

drivers/net/ethernet/stmicro/stmmac/stmmac_selftests.c

+6 −7
Original line number Original line Diff line number Diff line
@@ -1084,8 +1084,9 @@ static int stmmac_test_rxp(struct stmmac_priv *priv) 
	unsigned char addr[ETH_ALEN] = {0xde, 0xad, 0xbe, 0xef, 0x00, 0x00};

	unsigned char addr[ETH_ALEN] = {0xde, 0xad, 0xbe, 0xef, 0x00, 0x00};

	struct tc_cls_u32_offload cls_u32 = { };

	struct tc_cls_u32_offload cls_u32 = { };

	struct stmmac_packet_attrs attr = { };

	struct stmmac_packet_attrs attr = { };

	struct tc_action **actions, *act;

	struct tc_action **actions;

	struct tc_u32_sel *sel;

	struct tc_u32_sel *sel;

	struct tcf_gact *gact;

	struct tcf_exts *exts;

	struct tcf_exts *exts;

	int ret, i, nk = 1;

	int ret, i, nk = 1;
@@ -1110,8 +1111,8 @@ static int stmmac_test_rxp(struct stmmac_priv *priv) 
		goto cleanup_exts;

		goto cleanup_exts;

	}

	}





	act = kcalloc(nk, sizeof(*act), GFP_KERNEL);

	gact = kcalloc(nk, sizeof(*gact), GFP_KERNEL);

	if (!act) {

	if (!gact) {

		ret = -ENOMEM;

		ret = -ENOMEM;

		goto cleanup_actions;

		goto cleanup_actions;

	}

	}
@@ -1126,9 +1127,7 @@ static int stmmac_test_rxp(struct stmmac_priv *priv) 
	exts->nr_actions = nk;

	exts->nr_actions = nk;

	exts->actions = actions;

	exts->actions = actions;

	for (i = 0; i < nk; i++) {

	for (i = 0; i < nk; i++) {

		struct tcf_gact *gact = to_gact(&act[i]);

		actions[i] = (struct tc_action *)&gact[i];



		actions[i] = &act[i];

		gact->tcf_action = TC_ACT_SHOT;

		gact->tcf_action = TC_ACT_SHOT;

	}

	}
@@ -1152,7 +1151,7 @@ static int stmmac_test_rxp(struct stmmac_priv *priv) 
	stmmac_tc_setup_cls_u32(priv, priv, &cls_u32);

	stmmac_tc_setup_cls_u32(priv, priv, &cls_u32);





cleanup_act:

cleanup_act:

	kfree(act);

	kfree(gact);

cleanup_actions:

cleanup_actions:

	kfree(actions);

	kfree(actions);

cleanup_exts:

cleanup_exts: