Re: [PATCH net v3 3/3] net: fealnx: bound card_idx to prevent out-of-bounds access

On Mon, Oct 19, 2026 at 01:43:03PM +0000, Жамбакиев Радий Рикардинович wrote:

From: Radiy Zhambakiev <redacted>

card_idx is a static counter that is incremented on every
probe. It can overflow and wrap to a negative value, which
then indexes options[] and full_duplex[] out of bounds.
Large values also no longer fit in the 12-byte boardname[]
buffer.

Bound card_idx to 99999, the largest value that still fits
into boardname, and fail the probe for any card beyond that.

fealnx is an old driver that cannot be tested properly on
real hardware, so a minimal best-effort guard was chosen
over a larger rework.

Found by Linux Verification Center (linuxtesting.org)

Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Cc: stable@vger.kernel.org
Signed-off-by: Radiy Zhambakiev <redacted>

Please drop the Fixes: when you repost to net-next. This is one of
those theoretical fixes which never happens and nobody cares about, so
there is no need to backport it to stable.

Reviewed-by: Andrew Lunn <andrew@lunn.ch>

    Andrew