• Gustavo A. R. Silva's avatar
    octeontx2-pf: Fix out-of-bounds read in otx2_get_fecparam() · 93efb0c6
    Gustavo A. R. Silva authored
    Code at line 967 implies that rsp->fwdata.supported_fec may be up to 4:
    
     967: if (rsp->fwdata.supported_fec <= FEC_MAX_INDEX)
    
    If rsp->fwdata.supported_fec evaluates to 4, then there is an
    out-of-bounds read at line 971 because fec is an array with
    a maximum of 4 elements:
    
     954         const int fec[] = {
     955                 ETHTOOL_FEC_OFF,
     956                 ETHTOOL_FEC_BASER,
     957                 ETHTOOL_FEC_RS,
     958                 ETHTOOL_FEC_BASER | ETHTOOL_FEC_RS};
     959 #define FEC_MAX_INDEX 4
    
     971: fecparam->fec = fec[rsp->fwdata.supported_fec];
    
    Fix this by properly indexing fec[] with rsp->fwdata.supported_fec - 1.
    In this case the proper indexes 0 to 3 are used when
    rsp->fwdata.supported_fec evaluates to a range of 1 to 4, correspondingly.
    
    Fixes: d0cf9503 ("octeontx2-pf: ethtool fec mode support")
    Addresses-Coverity-ID: 1501722 ("Out-of-bounds read")
    Signed-off-by: default avatarGustavo A. R. Silva <gustavoars@kernel.org>
    Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
    93efb0c6
otx2_ethtool.c 34.8 KB