prestera_hw_counters_get() iterates over resp->num_counters entries from the firmware response without verifying it does not exceed the number of entries requested. A firmware response claiming more counters than requested causes out-of-bounds reads from the response buffer and out-of-bounds writes to the caller stats array. Validate that num_counters does not exceed the requested count before iterating. Fixes: 6e36c7bcb461 ("net: prestera: add counter HW API") Signed-off-by: Aamir Ahmed --- drivers/net/ethernet/marvell/prestera/prestera_hw.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/drivers/net/ethernet/marvell/prestera/prestera_hw.c b/drivers/net/ethernet/marvell/prestera/prestera_hw.c index 7695cbb2ce62..c4cb5f22893c 100644 --- a/drivers/net/ethernet/marvell/prestera/prestera_hw.c +++ b/drivers/net/ethernet/marvell/prestera/prestera_hw.c @@ -2324,6 +2324,11 @@ int prestera_hw_counters_get(struct prestera_switch *sw, u32 idx, if (err) goto free_buff; + if (__le32_to_cpu(resp->num_counters) > *len) { + err = -EINVAL; + goto free_buff; + } + for (i = 0; i < __le32_to_cpu(resp->num_counters); i++) { stats[i].packets += __le64_to_cpu(resp->stats[i].packets); stats[i].bytes += __le64_to_cpu(resp->stats[i].bytes); -- 2.43.0