]> git.ipfire.org Git - thirdparty/linux.git/commit
net: airoha: fix foe_check_time allocation size
authorWayen Yan <win847@gmail.com>
Tue, 16 Jun 2026 11:52:36 +0000 (19:52 +0800)
committerJakub Kicinski <kuba@kernel.org>
Fri, 19 Jun 2026 01:03:12 +0000 (18:03 -0700)
commit5c121ee635680c93d7074becf14cfbaac140f80d
tree93ed99fabfce8563c932a281279ba299a5b2d461
parent440a9744928a26be71f7eb49c0489e509473c587
net: airoha: fix foe_check_time allocation size

foe_check_time is declared as u16 pointer but was allocated with
only ppe_num_entries bytes instead of ppe_num_entries * sizeof(u16).

When airoha_ppe_foe_verify_entry() is called with hash >= ppe_num_entries/2,
it writes beyond the allocated buffer, causing heap buffer overflow and
potential kernel crash.

Fixes: 6d5b601d52a2 ("net: airoha: ppe: Dynamically allocate foe_check_time array in airoha_ppe struct")
Signed-off-by: Wayen Yan <win847@gmail.com>
Acked-by: Lorenzo Bianconi <lorenzo@kernel.org>
Link: https://patch.msgid.link/178161119471.2163752.14373384830691569758@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
drivers/net/ethernet/airoha/airoha_ppe.c