octeontx2-af: CGX: add bounds check to cgx_speed_mbps index

cgx_speed_mbps has 13 elements but RESP_LINKSTAT_SPEED can yield values
0-15. If it returns a value >= 13, this causes an out-of-bounds array
access. Add a bounds check and default to speed 0 if the index is out of
range.

Fixes: 61071a871ea6 ("octeontx2-af: Forward CGX link notifications to PFs")
Cc: Sunil Goutham <sgoutham@marvell.com>
Cc: Linu Cherian <lcherian@marvell.com>
Cc: Geetha sowjanya <gakula@marvell.com>
Cc: hariprasad <hkelam@marvell.com>
Cc: Subbaraya Sundeep <sbhatta@marvell.com>
Cc: Andrew Lunn <andrew+netdev@lunn.ch>
Cc: stable <stable@kernel.org>
Signed-off-by: Sam Daly <sam@samdaly.ie>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Link: https://patch.msgid.link/2026051352-refined-demise-e88d@gregkh
Signed-off-by: Jakub Kicinski <kuba@kernel.org>

diff --git a/drivers/net/ethernet/marvell/octeontx2/af/cgx.c b/drivers/net/ethernet/marvell/octeontx2/af/cgx.c
index 4f33a816bc7a1bb12edda7de795c27eabffb5bef..2e94d5105016bf235d10429a08940025e4fdbbbe 100644 (file)
--- a/drivers/net/ethernet/marvell/octeontx2/af/cgx.c
+++ b/drivers/net/ethernet/marvell/octeontx2/af/cgx.c
@@ -1294,13 +1294,18 @@ static inline void link_status_user_format(u64 lstat,
                                           struct cgx_link_user_info *linfo,
                                           struct cgx *cgx, u8 lmac_id)
 {
+       unsigned int speed;
+
        linfo->link_up = FIELD_GET(RESP_LINKSTAT_UP, lstat);
        linfo->full_duplex = FIELD_GET(RESP_LINKSTAT_FDUPLEX, lstat);
-       linfo->speed = cgx_speed_mbps[FIELD_GET(RESP_LINKSTAT_SPEED, lstat)];
        linfo->an = FIELD_GET(RESP_LINKSTAT_AN, lstat);
        linfo->fec = FIELD_GET(RESP_LINKSTAT_FEC, lstat);
        linfo->lmac_type_id = FIELD_GET(RESP_LINKSTAT_LMAC_TYPE, lstat);
 
+       speed = FIELD_GET(RESP_LINKSTAT_SPEED, lstat);
+       linfo->speed = speed < ARRAY_SIZE(cgx_speed_mbps) ?
+                      cgx_speed_mbps[speed] : 0;
+
        if (linfo->lmac_type_id >= LMAC_MODE_MAX) {
                dev_err(&cgx->pdev->dev, "Unknown lmac_type_id %d reported by firmware on cgx port%d:%d",
                        linfo->lmac_type_id, cgx->cgx_id, lmac_id);