qede: fix out-of-bounds check for cqe->len_list[]

Move index check before element access.

Fixes: 896f1a2493b5 ("net: qlogic/qede: fix potential out-of-bounds read in qede_tpa_cont() and qede_tpa_end()")
Signed-off-by: Matvey Kovalev <matvey.kovalev@ispras.ru>
Link: https://patch.msgid.link/20260623144602.3521-1-matvey.kovalev@ispras.ru
Signed-off-by: Jakub Kicinski <kuba@kernel.org>

diff --git a/drivers/net/ethernet/qlogic/qede/qede_fp.c b/drivers/net/ethernet/qlogic/qede/qede_fp.c
index e338bfc8b7b2f201b2ec46363650a7c565245165..33e18bb6977401a4a4c0edda77dced947cb60237 100644 (file)
--- a/drivers/net/ethernet/qlogic/qede/qede_fp.c
+++ b/drivers/net/ethernet/qlogic/qede/qede_fp.c
@@ -961,7 +961,7 @@ static inline void qede_tpa_cont(struct qede_dev *edev,
 {
        int i;
 
-       for (i = 0; cqe->len_list[i] && i < ARRAY_SIZE(cqe->len_list); i++)
+       for (i = 0; i < ARRAY_SIZE(cqe->len_list) && cqe->len_list[i]; i++)
                qede_fill_frag_skb(edev, rxq, cqe->tpa_agg_index,
                                   le16_to_cpu(cqe->len_list[i]));
 
@@ -986,7 +986,7 @@ static int qede_tpa_end(struct qede_dev *edev,
                dma_unmap_page(rxq->dev, tpa_info->buffer.mapping,
                               PAGE_SIZE, rxq->data_direction);
 
-       for (i = 0; cqe->len_list[i] && i < ARRAY_SIZE(cqe->len_list); i++)
+       for (i = 0; i < ARRAY_SIZE(cqe->len_list) && cqe->len_list[i]; i++)
                qede_fill_frag_skb(edev, rxq, cqe->tpa_agg_index,
                                   le16_to_cpu(cqe->len_list[i]));
        if (unlikely(i > 1))