In the GRC dump path, "len" count of dword-sized registers are read into the previously-allocated GRC dump buffer. However, the amount of data written into the GRC dump buffer is never checked against the length of the dump buffer. This can result in writing past the end of the dump buffer's kmalloc and a kernel panic. Resolve this by clamping the amount of data written to the length of the dump buffer, avoiding the out-of-bounds memory access and panic. Fixes: d52c89f120de8 ("qed*: Utilize FW 8.37.2.0") Signed-off-by: Jamie Bainbridge --- drivers/net/ethernet/qlogic/qed/qed_debug.c | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/drivers/net/ethernet/qlogic/qed/qed_debug.c b/drivers/net/ethernet/qlogic/qed/qed_debug.c index 9c3d3dd2f84753100d3c639505677bd53e3ca543..2e88fd79a02e220fc05caa8c27bb7d41b4b37c0d 100644 --- a/drivers/net/ethernet/qlogic/qed/qed_debug.c +++ b/drivers/net/ethernet/qlogic/qed/qed_debug.c @@ -2085,6 +2085,13 @@ static u32 qed_grc_dump_addr_range(struct qed_hwfn *p_hwfn, dev_data->pretend.split_id = split_id; } + /* Ensure we don't write past the end of the GRC buffer */ + u32 buf_size_bytes = p_hwfn->cdev->dbg_features[DBG_FEATURE_GRC].buf_size; + u32 len_bytes = len * sizeof(u32); + + if (len_bytes > buf_size_bytes) + len = buf_size_bytes / sizeof(u32); + /* Read registers using GRC */ qed_read_regs(p_hwfn, p_ptt, dump_buf, addr, len); -- 2.39.5