When "snps,rx-queues-to-use" or "tx-queues-to-use" config in DTS is provided
current code will apply U8_MAX value for queues_to_use if there is input of
higher value. But actual maximum number of supported queues is set via
macro MTL_MAX_RX_QUEUES and MTL_MAX_TX_QUEUES, which currently have value of 8.
This value of U8_MAX will be capped to value provided by core in DMA
capabilities (dma_conf), but it does so only if core provides it.
This is true for XGMAC (dwxgmac2) and some GMAC (dwmac4),
but not for (dwmac1000). This capping is at later stage in stmmac_hw_init(),
and during stmmac_mtl_setup() we might parse fields outside allocated memory
if queues_to_use is over defines MTL_MAX_ values,
for example following rx_queues_cfg is array of size of MTL_MAX_RX_QUEUES.
Fix this by capping value to MTL_MAX during config parsing.
Reported-by: Sashiko <sashiko-bot@kernel.org>
Signed-off-by: Jakub Raczynski <j.raczynski@samsung.com>
Reviewed-by: Simon Horman <horms@kernel.org>
Link: https://patch.msgid.link/20260611113358.3379518-3-j.raczynski@samsung.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
/* Processing RX queues common config */
if (!of_property_read_u32(rx_node, "snps,rx-queues-to-use", &value)) {
- if (value > U8_MAX)
- value = U8_MAX;
+ if (value > MTL_MAX_RX_QUEUES)
+ value = MTL_MAX_RX_QUEUES;
plat->rx_queues_to_use = value;
}
/* Processing TX queues common config */
if (!of_property_read_u32(tx_node, "snps,tx-queues-to-use", &value)) {
- if (value > U8_MAX)
- value = U8_MAX;
+ if (value > MTL_MAX_TX_QUEUES)
+ value = MTL_MAX_TX_QUEUES;
plat->tx_queues_to_use = value;
}