FAILED: patch "[PATCH] octeontx2-af: CGX: add bounds check to cgx_speed_mbps index" failed to apply to 6.6-stable tree

PATCH New [email protected] 2 participants 3 messages May 28 – May 30

Subsystems (3)

Network drivers Stable branch Marvell OcteonTX2 RVU admin function driver

lore

Share & tools

lore

[email protected]

author maintainer

2026-05-28 10:03 UTC #0 lore raw

The patch below does not apply to the 6.6-stable tree.
If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to <[email protected]>.

To reproduce the conflict and resubmit, you may use the following commands:

git fetch https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ linux-6.6.y
git checkout FETCH_HEAD
git cherry-pick -x c0bf0a4f3f1f5f57aa83e1400ba4f56f0abfd542
# <resolve conflicts, build, test, etc.>
git commit -s
git send-email --to '<[email protected]>' --in-reply-to '2026052830-proofread-ludicrous-154a@gregkh' --subject-prefix 'PATCH 6.6.y' HEAD^..

Possible dependencies:

thanks,

greg k-h

------------------ original commit in Linus's tree ------------------

From c0bf0a4f3f1f5f57aa83e1400ba4f56f0abfd542 Mon Sep 17 00:00:00 2001
From: Sam Daly <[email protected]>
Date: Wed, 13 May 2026 18:42:53 +0200
Subject: [PATCH] octeontx2-af: CGX: add bounds check to cgx_speed_mbps index
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

cgx_speed_mbps has 13 elements but RESP_LINKSTAT_SPEED can yield values 0-15. If it returns a value >= 13, this causes an out-of-bounds array access. Add a bounds check and default to speed 0 if the index is out of range.

Fixes 61071a871ea6 ("octeontx2-af: Forward CGX link notifications to PFs")

Cc Sunil Goutham <[email protected]>

Cc Linu Cherian <[email protected]>

Cc Geetha sowjanya <[email protected]>

Cc hariprasad <[email protected]>

Cc Subbaraya Sundeep <[email protected]>

Cc Andrew Lunn <[email protected]>

Cc stable <[email protected]>

Signed-off-by Sam Daly <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

Link https://patch.msgid.link/2026051352-refined-demise-e88d@gregkh open here

Signed-off-by Jakub Kicinski <[email protected]>

drivers/net/ethernet/marvell/octeontx2/af/cgx.c +6 -1

index 4f33a816bc7a..2e94d5105016 100644
@@ -1294,13 +1294,18 @@ static inline void link_status_user_format(u64 lstat,
 					   struct cgx_link_user_info *linfo,
 					   struct cgx *cgx, u8 lmac_id)
 {
+	unsigned int speed;
+
 	linfo->link_up = FIELD_GET(RESP_LINKSTAT_UP, lstat);
 	linfo->full_duplex = FIELD_GET(RESP_LINKSTAT_FDUPLEX, lstat);
-	linfo->speed = cgx_speed_mbps[FIELD_GET(RESP_LINKSTAT_SPEED, lstat)];
 	linfo->an = FIELD_GET(RESP_LINKSTAT_AN, lstat);
 	linfo->fec = FIELD_GET(RESP_LINKSTAT_FEC, lstat);
 	linfo->lmac_type_id = FIELD_GET(RESP_LINKSTAT_LMAC_TYPE, lstat);
 
+	speed = FIELD_GET(RESP_LINKSTAT_SPEED, lstat);
+	linfo->speed = speed < ARRAY_SIZE(cgx_speed_mbps) ?
+		       cgx_speed_mbps[speed] : 0;
+
 	if (linfo->lmac_type_id >= LMAC_MODE_MAX) {
 		dev_err(&cgx->pdev->dev, "Unknown lmac_type_id %d reported by firmware on cgx port%d:%d",
 			linfo->lmac_type_id, cgx->cgx_id, lmac_id);

Sasha Levin

maintainer

2026-05-30 14:26 UTC #1 lore raw

PATCH 1/2 octeontx2-af: replace deprecated strncpy with strscpy

From: Justin Stitt <[email protected]>

[ Upstream commit 473f8f2d1bfe1103f20140fdc80cad406b4d68c0 ]

strncpy is deprecated for use on NUL-terminated destination strings
[1] and as such we should prefer more robust and less ambiguous string interfaces.

We can see that linfo->lmac_type is expected to be NUL-terminated based on the ... - 1's present in the current code. Presumably making room for a NUL-byte at the end of the buffer.

Considering the above, a suitable replacement is strscpy [2] due to the fact that it guarantees NUL-termination on the destination buffer without unnecessarily NUL-padding.

Let's also prefer the more idiomatic strscpy usage of (dest, src, sizeof(dest)) rather than (dest, src, SOME_LEN).

Link https://www.kernel.org/doc/html/latest/process/deprecated.html#strncpy-on-nul-terminated-strings [1]

Link https://manpages.debian.org/testing/linux-manual-4.8/strscpy.9.en.html [2]

Link https://github.com/KSPP/linux/issues/90

Signed-off-by Justin Stitt <[email protected]>

Reviewed-by Kees Cook <[email protected]>

Link https://lore.kernel.org/r/20231010-strncpy-drivers-net-ethernet-marvell-octeontx2-af-cgx-c-v1-1-a443e18f9de8@google.com open here

Signed-off-by Jakub Kicinski <[email protected]>

Stable-dep-of: c0bf0a4f3f1f ("octeontx2-af: CGX: add bounds check to cgx_speed_mbps index")

Signed-off-by Sasha Levin <[email protected]>

---
 drivers/net/ethernet/marvell/octeontx2/af/cgx.c | 8 +++-----
 1 file changed, 3 insertions(+), 5 deletions(-)

drivers/net/ethernet/marvell/octeontx2/af/cgx.c +3 -5

index 278dc1aabd4b4..394061a3d38c7 100644
@@ -1286,8 +1286,6 @@ static inline void link_status_user_format(u64 lstat,
 					   struct cgx_link_user_info *linfo,
 					   struct cgx *cgx, u8 lmac_id)
 {
-	const char *lmac_string;
-
 	linfo->link_up = FIELD_GET(RESP_LINKSTAT_UP, lstat);
 	linfo->full_duplex = FIELD_GET(RESP_LINKSTAT_FDUPLEX, lstat);
 	linfo->speed = cgx_speed_mbps[FIELD_GET(RESP_LINKSTAT_SPEED, lstat)];

@@ -1298,12 +1296,12 @@ static inline void link_status_user_format(u64 lstat,
 	if (linfo->lmac_type_id >= LMAC_MODE_MAX) {
 		dev_err(&cgx->pdev->dev, "Unknown lmac_type_id %d reported by firmware on cgx port%d:%d",
 			linfo->lmac_type_id, cgx->cgx_id, lmac_id);
-		strncpy(linfo->lmac_type, "Unknown", LMACTYPE_STR_LEN - 1);
+		strscpy(linfo->lmac_type, "Unknown", sizeof(linfo->lmac_type));
 		return;
 	}
 
-	lmac_string = cgx_lmactype_string[linfo->lmac_type_id];
-	strncpy(linfo->lmac_type, lmac_string, LMACTYPE_STR_LEN - 1);
+	strscpy(linfo->lmac_type, cgx_lmactype_string[linfo->lmac_type_id],
+		sizeof(linfo->lmac_type));
 }
 
 /* Hardware event handlers */

Signature · 1 line

2.53.0

Sasha Levin

maintainer

2026-05-30 14:26 UTC #2 lore raw

PATCH 2/2 octeontx2-af: CGX: add bounds check to cgx_speed_mbps index

From: Sam Daly <[email protected]>

[ Upstream commit c0bf0a4f3f1f5f57aa83e1400ba4f56f0abfd542 ]

Fixes 61071a871ea6 ("octeontx2-af: Forward CGX link notifications to PFs")

Cc Sunil Goutham <[email protected]>

Cc Linu Cherian <[email protected]>

Cc Geetha sowjanya <[email protected]>

Cc hariprasad <[email protected]>

Cc Subbaraya Sundeep <[email protected]>

Cc Andrew Lunn <[email protected]>

Cc stable <[email protected]>

Signed-off-by Sam Daly <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

Link https://patch.msgid.link/2026051352-refined-demise-e88d@gregkh open here

Signed-off-by Jakub Kicinski <[email protected]>

Signed-off-by Sasha Levin <[email protected]>

---
 drivers/net/ethernet/marvell/octeontx2/af/cgx.c | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

drivers/net/ethernet/marvell/octeontx2/af/cgx.c +6 -1

index 394061a3d38c7..d415d5dbc1104 100644
@@ -1286,13 +1286,18 @@ static inline void link_status_user_format(u64 lstat,
 					   struct cgx_link_user_info *linfo,
 					   struct cgx *cgx, u8 lmac_id)
 {
+	unsigned int speed;
+
 	linfo->link_up = FIELD_GET(RESP_LINKSTAT_UP, lstat);
 	linfo->full_duplex = FIELD_GET(RESP_LINKSTAT_FDUPLEX, lstat);
-	linfo->speed = cgx_speed_mbps[FIELD_GET(RESP_LINKSTAT_SPEED, lstat)];
 	linfo->an = FIELD_GET(RESP_LINKSTAT_AN, lstat);
 	linfo->fec = FIELD_GET(RESP_LINKSTAT_FEC, lstat);
 	linfo->lmac_type_id = FIELD_GET(RESP_LINKSTAT_LMAC_TYPE, lstat);
 
+	speed = FIELD_GET(RESP_LINKSTAT_SPEED, lstat);
+	linfo->speed = speed < ARRAY_SIZE(cgx_speed_mbps) ?
+		       cgx_speed_mbps[speed] : 0;
+
 	if (linfo->lmac_type_id >= LMAC_MODE_MAX) {
 		dev_err(&cgx->pdev->dev, "Unknown lmac_type_id %d reported by firmware on cgx port%d:%d",
 			linfo->lmac_type_id, cgx->cgx_id, lmac_id);

Signature · 1 line

2.53.0