From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Date: Fri, 18 Oct 2024 13:14:32 +0000 (+0200)
Subject: 4.19-stable patches
X-Git-Tag: v5.10.228~48
X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=e8191db3bd18afbb9720d56080a6212fdc4992b4;p=thirdparty%2Fkernel%2Fstable-queue.git

4.19-stable patches

added patches:
	net-dsa-mv88e6xxx-fix-out-of-bound-access.patch
---

diff --git a/queue-4.19/net-dsa-mv88e6xxx-fix-out-of-bound-access.patch b/queue-4.19/net-dsa-mv88e6xxx-fix-out-of-bound-access.patch
new file mode 100644
index 00000000000..23aee884bc0
--- /dev/null
+++ b/queue-4.19/net-dsa-mv88e6xxx-fix-out-of-bound-access.patch
@@ -0,0 +1,36 @@
+From 528876d867a23b5198022baf2e388052ca67c952 Mon Sep 17 00:00:00 2001
+From: Joseph Huang <Joseph.Huang@garmin.com>
+Date: Mon, 19 Aug 2024 19:52:50 -0400
+Subject: net: dsa: mv88e6xxx: Fix out-of-bound access
+
+From: Joseph Huang <Joseph.Huang@garmin.com>
+
+commit 528876d867a23b5198022baf2e388052ca67c952 upstream.
+
+If an ATU violation was caused by a CPU Load operation, the SPID could
+be larger than DSA_MAX_PORTS (the size of mv88e6xxx_chip.ports[] array).
+
+Fixes: 75c05a74e745 ("net: dsa: mv88e6xxx: Fix counting of ATU violations")
+Signed-off-by: Joseph Huang <Joseph.Huang@garmin.com>
+Reviewed-by: Andrew Lunn <andrew@lunn.ch>
+Link: https://patch.msgid.link/20240819235251.1331763-1-Joseph.Huang@garmin.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Bruno VERNAY <bruno.vernay@se.com>
+Signed-off-by: Hugo SIMELIERE <hsimeliere.opensource@witekio.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/dsa/mv88e6xxx/global1_atu.c |    3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/drivers/net/dsa/mv88e6xxx/global1_atu.c
++++ b/drivers/net/dsa/mv88e6xxx/global1_atu.c
+@@ -363,7 +363,8 @@ static irqreturn_t mv88e6xxx_g1_atu_prob
+ 		dev_err_ratelimited(chip->dev,
+ 				    "ATU full violation for %pM portvec %x spid %d\n",
+ 				    entry.mac, entry.portvec, spid);
+-		chip->ports[spid].atu_full_violation++;
++		if (spid < ARRAY_SIZE(chip->ports))
++			chip->ports[spid].atu_full_violation++;
+ 	}
+ 	mutex_unlock(&chip->reg_lock);
+ 
diff --git a/queue-4.19/series b/queue-4.19/series
index bf82bb512b7..ac14dbb8f41 100644
--- a/queue-4.19/series
+++ b/queue-4.19/series
@@ -271,3 +271,4 @@ arm64-probes-fix-simulate_ldr-_literal.patch
 pci-add-function-0-dma-alias-quirk-for-glenfly-arise-chip.patch
 fat-fix-uninitialized-variable.patch
 kvm-fix-a-data-race-on-last_boosted_vcpu-in-kvm_vcpu_on_spin.patch
+net-dsa-mv88e6xxx-fix-out-of-bound-access.patch