Re: [PATCH net-next 06/13] net/mlx5: LAG, size debugfs buffers by port count

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Medium] net/mlx5: heap buffer overflow in mapping_show() due to unbounded port iteration
--

commit 246f550ad218121a01820b63c27f405fffbeac7b
Author: Shay Drory <shayd@nvidia.com>

net/mlx5: LAG, size debugfs buffers by port count

This commit changes mapping_show() in the debugfs interface to dynamically
allocate the ports buffer based on the actual number of ports rather than
using a fixed maximum size.

> diff --git a/drivers/net/ethernet/mellanox/mlx5/core/lag/debugfs.c b/drivers/net/ethernet/mellanox/mlx5/core/lag/debugfs.c
> index e9b8d79d2d21e..44296789d6567 100644
> --- a/drivers/net/ethernet/mellanox/mlx5/core/lag/debugfs.c
> +++ b/drivers/net/ethernet/mellanox/mlx5/core/lag/debugfs.c
> @@ -101,14 +101,18 @@ static int flags_show(struct seq_file *file, void *priv)
>  static int mapping_show(struct seq_file *file, void *priv)
>  {
>  	struct mlx5_core_dev *dev = file->private;
> -	u8 ports[MLX5_MAX_PORTS] = {};
>  	struct mlx5_lag *ldev;
>  	bool hash = false;
>  	bool lag_active;
>  	int i, idx = 0;
>  	int num_ports;
> +	u8 *ports;
>  
>  	ldev = mlx5_lag_dev(dev);
> +	ports = kcalloc(ldev->ports, sizeof(*ports), GFP_KERNEL);
> +	if (!ports)
> +		return -ENOMEM;
> +

[Severity: Medium]
Can this allocation size lead to a heap buffer overflow?

The ports array is dynamically sized to ldev->ports. However, it is
populated below this allocation using mlx5_ldev_for_each(), which iterates
up to MLX5_MAX_PORTS:

    mlx5_ldev_for_each(i, 0, ldev)
        ports[idx++] = ldev->v2p_map[i];

If firmware anomalies or hotplugging cause mlx5_ldev_for_each() to find more
devices than ldev->ports, will this write past the end of the ports buffer?

Similarly, when hash mapping is used, mapping_show() calls
mlx5_infer_tx_enabled() to populate the buffer:

drivers/net/ethernet/mellanox/mlx5/core/lag/lag.c:mlx5_infer_tx_enabled()
    mlx5_ldev_for_each(i, 0, ldev)
        if (tracker->netdev_state[i].tx_enabled &&
            tracker->netdev_state[i].link_up)
            ports[(*num_enabled)++] = i;

Could this path also overflow the buffer since it shares the same unbounded
iteration logic?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260923103830.1183-1-tariqt@nvidia.com?part=6