mirror of
https://github.com/torvalds/linux.git
synced 2026-10-17 14:30:03 +02:00
14cb1e7702
The per‑processor buffering scheme is supported only if the
number of pools (nrxqs * 2) does not exceed MVPP2_BM_MAX_POOLS (8).
This is already checked in mvpp2_probe() during the initial
activation of percpu_pools.
However, mvpp2_change_mtu() may later call
mvpp2_bm_switch_buffers(priv, true) without this check, which can
lead to an out-of-bounds access in the priv->page_pool array in
mvpp2_bm_init(). The array is sized to hold MVPP2_PORT_MAX_RXQ
entries, and mvpp2_get_nrxqs() may return exactly that value. The
per-CPU scheme then doubles it to nrxqs * 2, exceeding the array
bounds.
Check that the hardware version is MVPP22 or newer and that the
number of pools (nrxqs * 2) does not exceed MVPP2_BM_MAX_POOLS
before switching to per-CPU mode.
Found by Linux Verification Center (linuxtesting.org) with SVACE.
Fixes:
|
||
|---|---|---|
| .. | ||
| Makefile | ||
| mvpp2_cls.c | ||
| mvpp2_cls.h | ||
| mvpp2_debugfs.c | ||
| mvpp2_main.c | ||
| mvpp2_prs.c | ||
| mvpp2_prs.h | ||
| mvpp2_tai.c | ||
| mvpp2.h | ||