]> git.ipfire.org Git - thirdparty/kernel/linux.git/commit
dpaa2-switch: add bounds check for if_id in IRQ handler
authorJunrui Luo <moonafterrain@outlook.com>
Wed, 28 Jan 2026 16:55:13 +0000 (00:55 +0800)
committerJakub Kicinski <kuba@kernel.org>
Fri, 30 Jan 2026 03:40:51 +0000 (19:40 -0800)
commit31a7a0bbeb006bac2d9c81a2874825025214b6d8
treec2dc0c14e513f83b6adfa3f76b7d00cd0888c164
parent82deb2816ebbdc79083e2d76e0ef141a48aec69c
dpaa2-switch: add bounds check for if_id in IRQ handler

The IRQ handler extracts if_id from the upper 16 bits of the hardware
status register and uses it to index into ethsw->ports[] without
validation. Since if_id can be any 16-bit value (0-65535) but the ports
array is only allocated with sw_attr.num_ifs elements, this can lead to
an out-of-bounds read potentially.

Add a bounds check before accessing the array, consistent with the
existing validation in dpaa2_switch_rx().

Reported-by: Yuhao Jiang <danisjiang@gmail.com>
Reported-by: Junrui Luo <moonafterrain@outlook.com>
Fixes: 24ab724f8a46 ("dpaa2-switch: use the port index in the IRQ handler")
Signed-off-by: Junrui Luo <moonafterrain@outlook.com>
Link: https://patch.msgid.link/SYBPR01MB7881D420AB43FF1A227B84AFAF91A@SYBPR01MB7881.ausprd01.prod.outlook.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
drivers/net/ethernet/freescale/dpaa2/dpaa2-switch.c