fsl/fman: Validate cell-index value obtained from Device Tree

Cell-index value is obtained from Device Tree and then used to calculate
the index for accessing arrays port_mfl[], mac_mfl[] and intr_mng[].
In case of broken DT due to any error cell-index can contain any value
and it is possible to go beyond the array boundaries which can lead
at least to memory corruption.

Validate cell-index value obtained from Device Tree.

Found by Linux Verification Center (linuxtesting.org) with SVACE.

Reviewed-by: Sean Anderson <sean.anderson@seco.com>
Signed-off-by: Aleksandr Mishin <amishin@t-argos.ru>
Link: https://patch.msgid.link/20241028065824.15452-1-amishin@t-argos.ru
Signed-off-by: Jakub Kicinski <kuba@kernel.org>

diff --git a/drivers/net/ethernet/freescale/fman/fman.c b/drivers/net/ethernet/freescale/fman/fman.c
index d96028f01770cff4465416617f30532846e0ec24..fb416d60dcd7276a97b9e9b6193f886d3580195a 100644 (file)
--- a/drivers/net/ethernet/freescale/fman/fman.c
+++ b/drivers/net/ethernet/freescale/fman/fman.c
@@ -24,7 +24,6 @@
 
 /* General defines */
 #define FMAN_LIODN_TBL                 64      /* size of LIODN table */
-#define MAX_NUM_OF_MACS                        10
 #define FM_NUM_OF_FMAN_CTRL_EVENT_REGS 4
 #define BASE_RX_PORTID                 0x08
 #define BASE_TX_PORTID                 0x28

diff --git a/drivers/net/ethernet/freescale/fman/fman.h b/drivers/net/ethernet/freescale/fman/fman.h
index 2ea575a46675b024095d2c7520c977fabdee7246..74eb62eba0d7fffb44edbe0583a71e21e7027af3 100644 (file)
--- a/drivers/net/ethernet/freescale/fman/fman.h
+++ b/drivers/net/ethernet/freescale/fman/fman.h
@@ -74,6 +74,9 @@
 #define BM_MAX_NUM_OF_POOLS            64 /* Buffers pools */
 #define FMAN_PORT_MAX_EXT_POOLS_NUM    8  /* External BM pools per Rx port */
 
+/* General defines */
+#define MAX_NUM_OF_MACS                        10
+
 struct fman; /* FMan data */
 
 /* Enum for defining port types */

diff --git a/drivers/net/ethernet/freescale/fman/mac.c b/drivers/net/ethernet/freescale/fman/mac.c
index c7bff9490ce02b65d27adaef8bd47fc2ca65e237..a39fcea6a77a0fbfd3f8d85f5b2ab48d2467e089 100644 (file)
--- a/drivers/net/ethernet/freescale/fman/mac.c
+++ b/drivers/net/ethernet/freescale/fman/mac.c
@@ -217,6 +217,11 @@ static int mac_probe(struct platform_device *_of_dev)
                err = -EINVAL;
                goto _return_dev_put;
        }
+       if (val >= MAX_NUM_OF_MACS) {
+               dev_err(dev, "cell-index value is too big for %pOF\n", mac_node);
+               err = -EINVAL;
+               goto _return_dev_put;
+       }
        priv->cell_index = (u8)val;
 
        /* Get the MAC address */