When "snps,rx-queues-to-use" or "tx-queues-to-use" config in DTS is provided current code will apply U8_MAX value for queues_to_use if there is input of higher value. But actual maximum number of supported queues is set via macro MTL_MAX_RX_QUEUES and MTL_MAX_TX_QUEUES, which currently have value of 8. This value of U8_MAX will be capped to value provided by core in DMA capabilities (dma_conf), but it does so only if core provides it. This is true for XGMAC (dwxgmac2) and some GMAC (dwmac4), but not for (dwmac1000). This capping is at later stage in stmmac_hw_init(), and during stmmac_mtl_setup() we might parse fields outside allocated memory if queues_to_use is over defines MTL_MAX_ values, for example following rx_queues_cfg is array of size of MTL_MAX_RX_QUEUES. Fix this by capping value to MTL_MAX during config parsing. Fixes: 94808793fed71 ("net: stmmac: use u8 for ?x_queues_to_use and number_?x_queues") Reported-by: Sashiko Signed-off-by: Jakub Raczynski --- drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c index 5cae2aa72906..dc5f951a311d 100644 --- a/drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c +++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c @@ -156,8 +156,8 @@ static int stmmac_mtl_setup(struct platform_device *pdev, /* Processing RX queues common config */ if (!of_property_read_u32(rx_node, "snps,rx-queues-to-use", &value)) { - if (value > U8_MAX) - value = U8_MAX; + if (value > MTL_MAX_RX_QUEUES) + value = MTL_MAX_RX_QUEUES; plat->rx_queues_to_use = value; } @@ -210,8 +210,8 @@ static int stmmac_mtl_setup(struct platform_device *pdev, /* Processing TX queues common config */ if (!of_property_read_u32(tx_node, "snps,tx-queues-to-use", &value)) { - if (value > U8_MAX) - value = U8_MAX; + if (value > MTL_MAX_TX_QUEUES) + value = MTL_MAX_TX_QUEUES; plat->tx_queues_to_use = value; } -- 2.34.1