dev.dpdk.org archive mirror
 help / color / mirror / Atom feed
From: Hemant Agrawal <hemant.agrawal@nxp.com>
To: dev@dpdk.org, stephen@networkplumber.org, david.marchand@redhat.com
Cc: Vanshika Shukla <vanshika.shukla@nxp.com>, stable@dpdk.org
Subject: [PATCH 02/11] net/enetfec: fix out-of-bounds access in UIO mapping
Date: Mon,  6 Oct 2025 13:34:01 +0530	[thread overview]
Message-ID: <20251006080410.1433284-3-hemant.agrawal@nxp.com> (raw)
In-Reply-To: <20251006080410.1433284-1-hemant.agrawal@nxp.com>

From: Vanshika Shukla <vanshika.shukla@nxp.com>

NXP internal Coverity flagged a potential out-of-bounds
access due to invalid mapping size. This patch adds a check to
ensure the mapping size is within valid bounds before proceeding
with memory mapping.

Fixes: b84fdd39638b ("net/enetfec: support UIO")
Cc: stable@dpdk.org

Signed-off-by: Vanshika Shukla <vanshika.shukla@nxp.com>
---
 drivers/net/enetfec/enet_uio.c | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/drivers/net/enetfec/enet_uio.c b/drivers/net/enetfec/enet_uio.c
index 23cb4e7e93..f32d5e1b1e 100644
--- a/drivers/net/enetfec/enet_uio.c
+++ b/drivers/net/enetfec/enet_uio.c
@@ -1,5 +1,5 @@
 /* SPDX-License-Identifier: BSD-3-Clause
- * Copyright 2021,2024 NXP
+ * Copyright 2021,2024-2025 NXP
  */
 
 #include <stdbool.h>
@@ -142,6 +142,10 @@ uio_map_mem(int uio_device_fd, int uio_device_id,
 	}
 	/* Read mapping size and physical address expressed in hexa(base 16) */
 	uio_map_size = strtol(uio_map_size_str, NULL, 16);
+	if (uio_map_size <= 0 || uio_map_size > INT_MAX) {
+		ENETFEC_PMD_ERR("Invalid mapping size: %u.", uio_map_size);
+		return NULL;
+	}
 	uio_map_p_addr = strtol(uio_map_p_addr_str, NULL, 16);
 
 	if (uio_map_id == 0) {
-- 
2.25.1


  parent reply	other threads:[~2025-10-06  8:04 UTC|newest]

Thread overview: 12+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2025-10-06  8:03 [PATCH 00/11] net/enetc: various fixes and enhancements Hemant Agrawal
2025-10-06  8:04 ` [PATCH 01/11] net/enetfec: fix file descriptor leak on read error Hemant Agrawal
2025-10-06  8:04 ` Hemant Agrawal [this message]
2025-10-06  8:04 ` [PATCH 03/11] net/enetfec: fix buffer descriptor size configuration Hemant Agrawal
2025-10-06  8:04 ` [PATCH 04/11] net/enetfec: fix incorrect Tx queue free logic Hemant Agrawal
2025-10-06  8:04 ` [PATCH 05/11] net/enetfec: fix checksum flag handling and error return Hemant Agrawal
2025-10-06  8:04 ` [PATCH 06/11] net/enetfec: fix to reject multi-queue configuration Hemant Agrawal
2025-10-06  8:04 ` [PATCH 07/11] net/enetfec: fix memory leak in Rx buffer cleanup Hemant Agrawal
2025-10-06  8:04 ` [PATCH 08/11] net/enetfec: fix to add check for Rx/Tx deferred queue Hemant Agrawal
2025-10-06  8:04 ` [PATCH 09/11] net/enetfec: handle cache for forwarded packets Hemant Agrawal
2025-10-06  8:04 ` [PATCH 10/11] net/enetfec: support to set MAC address Hemant Agrawal
2025-10-06  8:04 ` [PATCH 11/11] net/enetfec: add software packet type parsing and cleanup Hemant Agrawal

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20251006080410.1433284-3-hemant.agrawal@nxp.com \
    --to=hemant.agrawal@nxp.com \
    --cc=david.marchand@redhat.com \
    --cc=dev@dpdk.org \
    --cc=stable@dpdk.org \
    --cc=stephen@networkplumber.org \
    --cc=vanshika.shukla@nxp.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).