Skip to contentSkip to conversation

octeontx2-af: CGX: add bounds check to cgx_speed_mbps index

PATCH Applied Greg Kroah-Hartman 2 participants 2 messages May 13 – May 16

Subsystems (3)
Networking Network drivers Marvell OcteonTX2 RVU admin function driver
lore
Share & tools
lore

Greg Kroah-Hartman

author
#0 lore raw

PATCH 1/1 octeontx2-af: CGX: add bounds check to cgx_speed_mbps index

From: Sam Daly <[email protected]>

cgx_speed_mbps has 13 elements but RESP_LINKSTAT_SPEED can yield values 0-15. If it returns a value >= 13, this causes an out-of-bounds array access. Add a bounds check and default to speed 0 if the index is out of range.

Fixes 61071a871ea6 ("octeontx2-af: Forward CGX link notifications to PFs")
Cc Sunil Goutham <[email protected]>
Cc Linu Cherian <[email protected]>
Cc Geetha sowjanya <[email protected]>
Cc hariprasad <[email protected]>
Cc Subbaraya Sundeep <[email protected]>
Cc Andrew Lunn <[email protected]>
Cc "David S. Miller" <[email protected]>
Cc Eric Dumazet <[email protected]>
Cc Jakub Kicinski <[email protected]>
Cc Paolo Abeni <[email protected]>
Assisted-by gkh_clanker_2000
Cc stable <[email protected]>
Signed-off-by Sam Daly <[email protected]>
Signed-off-by Greg Kroah-Hartman <[email protected]>
---
 drivers/net/ethernet/marvell/octeontx2/af/cgx.c | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)
drivers/net/ethernet/marvell/octeontx2/af/cgx.c +6 -1
index 4f33a816bc7a..2e94d5105016 100644
@@ -1294,13 +1294,18 @@ static inline void link_status_user_format(u64 lstat,
 					   struct cgx_link_user_info *linfo,
 					   struct cgx *cgx, u8 lmac_id)
 {
+	unsigned int speed;
+
 	linfo->link_up = FIELD_GET(RESP_LINKSTAT_UP, lstat);
 	linfo->full_duplex = FIELD_GET(RESP_LINKSTAT_FDUPLEX, lstat);
-	linfo->speed = cgx_speed_mbps[FIELD_GET(RESP_LINKSTAT_SPEED, lstat)];
 	linfo->an = FIELD_GET(RESP_LINKSTAT_AN, lstat);
 	linfo->fec = FIELD_GET(RESP_LINKSTAT_FEC, lstat);
 	linfo->lmac_type_id = FIELD_GET(RESP_LINKSTAT_LMAC_TYPE, lstat);
 
+	speed = FIELD_GET(RESP_LINKSTAT_SPEED, lstat);
+	linfo->speed = speed < ARRAY_SIZE(cgx_speed_mbps) ?
+		       cgx_speed_mbps[speed] : 0;
+
 	if (linfo->lmac_type_id >= LMAC_MODE_MAX) {
 		dev_err(&cgx->pdev->dev, "Unknown lmac_type_id %d reported by firmware on cgx port%d:%d",
 			linfo->lmac_type_id, cgx->cgx_id, lmac_id);
Signature · 1 line
2.54.0
CI Applied
#1 lore raw
This patch was applied to netdev/net.git (main) by Jakub Kicinski <[email protected]>:

Hello:

This patch was applied to netdev/net.git (main)
by Jakub Kicinski <[email protected]>:

Quoted 8 lines · On Wed, 13 May 2026 18:42:53 +0200 you wrote:

From: Sam Daly <[email protected]>

cgx_speed_mbps has 13 elements but RESP_LINKSTAT_SPEED can yield values 0-15. If it returns a value >= 13, this causes an out-of-bounds array access. Add a bounds check and default to speed 0 if the index is out of range.

[...]

Here is the summary with links:
- [net] octeontx2-af: CGX: add bounds check to cgx_speed_mbps index

    https://git.kernel.org/netdev/net/c/c0bf0a4f3f1f

You are awesome, thank you!

Signature · 2 lines
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html