Thread (25 messages) 25 messages, 4 authors, 1d ago

Re: [PATCH net v2 07/10] net: systemport: Fix out-of-bounds array accesses in DSA queue mapping

From: Jakub Kicinski <kuba@kernel.org>
Date: 2026-09-29 00:05:47
Also in: lkml

On Tue, 22 Sep 2026 16:24:37 -0700 Florian Fainelli wrote:
The priv->ring_map array has a fixed size of (DSA_MAX_PORTS * 8). In
bcm_sysport_select_queue(), bcm_sysport_map_queues(), and
bcm_sysport_unmap_queues(), indices calculated as
(qp + port * num_tx_queues) were accessed without checking against
ARRAY_SIZE(priv->ring_map). If unusual port or queue configurations are
encountered, this could lead to out-of-bounds array accesses.
same question - can this really happen?
Does "unusual port or queue configuration" imply some runtime config?
Or bad DT?
Keyboard shortcuts
hback out one level
jnext message in thread
kprevious message in thread
ldrill in
Escclose help / fold thread tree
?toggle this help