Skip to content

Commit 93efb0c

Browse files
GustavoARSilvadavem330
authored andcommitted
octeontx2-pf: Fix out-of-bounds read in otx2_get_fecparam()
Code at line 967 implies that rsp->fwdata.supported_fec may be up to 4: 967: if (rsp->fwdata.supported_fec <= FEC_MAX_INDEX) If rsp->fwdata.supported_fec evaluates to 4, then there is an out-of-bounds read at line 971 because fec is an array with a maximum of 4 elements: 954 const int fec[] = { 955 ETHTOOL_FEC_OFF, 956 ETHTOOL_FEC_BASER, 957 ETHTOOL_FEC_RS, 958 ETHTOOL_FEC_BASER | ETHTOOL_FEC_RS}; 959 #define FEC_MAX_INDEX 4 971: fecparam->fec = fec[rsp->fwdata.supported_fec]; Fix this by properly indexing fec[] with rsp->fwdata.supported_fec - 1. In this case the proper indexes 0 to 3 are used when rsp->fwdata.supported_fec evaluates to a range of 1 to 4, correspondingly. Fixes: d0cf950 ("octeontx2-pf: ethtool fec mode support") Addresses-Coverity-ID: 1501722 ("Out-of-bounds read") Signed-off-by: Gustavo A. R. Silva <[email protected]> Signed-off-by: David S. Miller <[email protected]>
1 parent a6e0ee3 commit 93efb0c

File tree

1 file changed

+1
-1
lines changed

1 file changed

+1
-1
lines changed

drivers/net/ethernet/marvell/octeontx2/nic/otx2_ethtool.c

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -968,7 +968,7 @@ static int otx2_get_fecparam(struct net_device *netdev,
968968
if (!rsp->fwdata.supported_fec)
969969
fecparam->fec = ETHTOOL_FEC_NONE;
970970
else
971-
fecparam->fec = fec[rsp->fwdata.supported_fec];
971+
fecparam->fec = fec[rsp->fwdata.supported_fec - 1];
972972
}
973973
return 0;
974974
}

0 commit comments

Comments
 (0)