net: enetc: check the number of BDs needed for xdp_frame

The size of xdp_redirect_arr array is ENETC_MAX_SKB_FRAGS. However, the
number of fragments contained in xdp_frame may be greater than or equal
to ENETC_MAX_SKB_FRAGS, which will cause the access to xdp_redirect_arr
to be out of bounds.

Fixes: 9d2b68cc108d ("net: enetc: add support for XDP_REDIRECT")
Signed-off-by: Wei Fang <wei.fang@nxp.com>
Link: https://patch.msgid.link/20260626073244.2168214-1-wei.fang@oss.nxp.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>

diff --git a/drivers/net/ethernet/freescale/enetc/enetc.c b/drivers/net/ethernet/freescale/enetc/enetc.c
index aa8a87124b103261348fe371ef158571d4c9000c..8e3f345dd9aacb102c2f0656b52e0124238d9afd 100644 (file)
--- a/drivers/net/ethernet/freescale/enetc/enetc.c
+++ b/drivers/net/ethernet/freescale/enetc/enetc.c
@@ -1783,6 +1783,7 @@ int enetc_xdp_xmit(struct net_device *ndev, int num_frames,
 {
        struct enetc_tx_swbd xdp_redirect_arr[ENETC_MAX_SKB_FRAGS] = {0};
        struct enetc_ndev_priv *priv = netdev_priv(ndev);
+       struct skb_shared_info *shinfo;
        struct enetc_bdr *tx_ring;
        int xdp_tx_bd_cnt, i, k;
        int xdp_tx_frm_cnt = 0;
@@ -1798,6 +1799,12 @@ int enetc_xdp_xmit(struct net_device *ndev, int num_frames,
        prefetchw(ENETC_TXBD(*tx_ring, tx_ring->next_to_use));
 
        for (k = 0; k < num_frames; k++) {
+               if (xdp_frame_has_frags(frames[k])) {
+                       shinfo = xdp_get_shared_info_from_frame(frames[k]);
+                       if (unlikely((shinfo->nr_frags + 1) > ENETC_MAX_SKB_FRAGS))
+                               break;
+               }
+
                xdp_tx_bd_cnt = enetc_xdp_frame_to_xdp_tx_swbd(tx_ring,
                                                               xdp_redirect_arr,
                                                               frames[k]);