From: Akiva Goldberger mlx5_query_mtrc_caps() reads num_string_db from the MTRC capabilities register and uses it directly as a loop bound to populate the fixed-size base_address_out[STRINGS_DB_SECTIONS_NUM] and size_out[STRINGS_DB_SECTIONS_NUM] arrays in the tracer's str_db structure (STRINGS_DB_SECTIONS_NUM == 8). The field is 4 bits wide, so firmware can report up to 15. A value greater than STRINGS_DB_SECTIONS_NUM makes the loop write past the end of those arrays, corrupting adjacent fields of the fw_tracer structure on the kernel heap. Clamp the firmware-reported value before it is used. Fixes: f53aaa31cce7 ("net/mlx5: FW tracer, implement tracer logic") Signed-off-by: Akiva Goldberger Reviewed-by: Shay Drori Signed-off-by: Tariq Toukan --- drivers/net/ethernet/mellanox/mlx5/core/diag/fw_tracer.c | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/drivers/net/ethernet/mellanox/mlx5/core/diag/fw_tracer.c b/drivers/net/ethernet/mellanox/mlx5/core/diag/fw_tracer.c index adcc73e2a5b3..404736c46adf 100644 --- a/drivers/net/ethernet/mellanox/mlx5/core/diag/fw_tracer.c +++ b/drivers/net/ethernet/mellanox/mlx5/core/diag/fw_tracer.c @@ -64,6 +64,13 @@ static int mlx5_query_mtrc_caps(struct mlx5_fw_tracer *tracer) tracer->str_db.num_string_trace = MLX5_GET(mtrc_cap, out, num_string_trace); tracer->str_db.num_string_db = MLX5_GET(mtrc_cap, out, num_string_db); + if (tracer->str_db.num_string_db > STRINGS_DB_SECTIONS_NUM) { + mlx5_core_warn(dev, + "FWTracer: Firmware reports num_string_db (%u) > (%u), clamping\n", + tracer->str_db.num_string_db, + STRINGS_DB_SECTIONS_NUM); + tracer->str_db.num_string_db = STRINGS_DB_SECTIONS_NUM; + } tracer->owner = !!MLX5_GET(mtrc_cap, out, trace_owner); tracer->str_db.loaded = false; base-commit: 3f1f755366687d051174739fb99f7d560202f60b -- 2.44.0