github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-09-22 12:44:03 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

octeontx2-af: fix out-of-bounds read setting MSI-X irq affinity

Browse Source 
rvu_register_interrupts() walks every MSI-X vector and uses strstr()
to match "Mbox" or "FLR" in irq_name before pinning those interrupts
to CPU 0. irq_name is a per-vector NAME_SIZE buffer, but not every
slot is populated before this loop runs. strstr() keeps scanning until
it finds a NUL terminator, so an uninitialized slot can trigger a KASAN
slab-out-of-bounds read at boot when debug options are enabled.

Use strnstr() with NAME_SIZE to bound the search within each vector's
name buffer.

Fixes: 4e527f1e5c ("octeontx2-af: npc: cn20k: Add new mailboxes for CN20K silicon")
Signed-off-by: Anshumali Gaur <agaur@marvell.com>
Signed-off-by: Ratheesh Kannoth <rkannoth@marvell.com>
Link: https://patch.msgid.link/20260820055451.2642358-1-rkannoth@marvell.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
This commit is contained in:
Anshumali Gaur 2026-08-20 11:24:51 +05:30 committed by Jakub Kicinski
parent ec65631bd5
commit 4d5df98369
1 changed files with 2 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
drivers/net/ethernet/marvell/octeontx2/af/rvu.c
View File

@ -3331,8 +3331,8 @@ static int rvu_register_interrupts(struct rvu *rvu)
goto fail;
for (i = 0; i < rvu->num_vec; i++) {
if (strstr(&rvu->irq_name[i * NAME_SIZE], "Mbox") ||
strstr(&rvu->irq_name[i * NAME_SIZE], "FLR"))
if (strnstr(&rvu->irq_name[i * NAME_SIZE], "Mbox", NAME_SIZE) ||
strnstr(&rvu->irq_name[i * NAME_SIZE], "FLR", NAME_SIZE))
irq_set_affinity(pci_irq_vector(rvu->pdev, i),
cpumask_of(0));
}