ntb: ntb_hw_switchtec: Fix array-index-out-of-bounds access

[ Upstream commit c8ba7ad2cc1c7b90570aa347b8ebbe279f1eface ]

Number of MW LUTs depends on NTB configuration and can be set to MAX_MWS,
This patch protects against invalid index out of bounds access to mw_sizes
When invalid access print message to user that configuration is not valid.

Signed-off-by: Maciej Grochowski <Maciej.Grochowski@sony.com>
Signed-off-by: Jon Mason <jdmason@kudzu.us>
Signed-off-by: Sasha Levin <sashal@kernel.org>

diff --git a/drivers/ntb/hw/mscc/ntb_hw_switchtec.c b/drivers/ntb/hw/mscc/ntb_hw_switchtec.c
index f851397b65d6e529b02715b69d4f98ecbcc3de5c..f15ebab1381446c4832eed7640c003062a940f49 100644 (file)
--- a/drivers/ntb/hw/mscc/ntb_hw_switchtec.c
+++ b/drivers/ntb/hw/mscc/ntb_hw_switchtec.c
@@ -1314,6 +1314,12 @@ static void switchtec_ntb_init_shared(struct switchtec_ntb *sndev)
        for (i = 0; i < sndev->nr_lut_mw; i++) {
                int idx = sndev->nr_direct_mw + i;
 
+               if (idx >= MAX_MWS) {
+                       dev_err(&sndev->stdev->dev,
+                               "Total number of MW cannot be bigger than %d", MAX_MWS);
+                       break;
+               }
+
                sndev->self_shared->mw_sizes[idx] = LUT_SIZE;
        }
 }