Hello:
This series was applied to netdev/net.git (main)
by Jakub Kicinski [off-list ref]:
On Sat, 15 Aug 2026 21:54:38 +0200 you wrote:
From: Marek Czernohous <redacted>
Two bounds fixes in forcedeth, both in the same shape: a loop that walks
the register window one step too far. They are independent of each other
and touch different functions.
1/2 nv_suspend() and nv_resume() save and restore the non-PCI config
space with i <= register_size/sizeof(u32). On a VER3 device that is
exactly the length of saved_config_space[], so the last iteration
reads and writes one element past the array, and on resume it
writel()s that element one dword past the length the driver mapped.
UBSAN catches it.
[...]
Here is the summary with links:
- [net,1/2] forcedeth: fix off-by-one when saving/restoring non-PCI config space
https://git.kernel.org/netdev/net/c/9393f1d656a7
- [net,2/2] forcedeth: stop the tx_timeout register dump past the requested window
https://git.kernel.org/netdev/net/c/cfa9178ce2e5
You are awesome, thank you!
--
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html