Re: [PATCH v4 net-next 5/9] net: dsa: netc: initialize the group bitmap of ETT and ECT

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] Hardware ETT and ECT table out-of-bounds access due to incorrect group sizing based on available ports instead of physical ports.
--

commit 86672a593cae6156b47d02f0d2ead38cfa53953b
Author: Wei Fang <wei.fang@nxp.com>

net: dsa: netc: initialize the group bitmap of ETT and ECT

This commit calculates and allocates index bitmaps for the Egress Treatment
Table (ETT) and Egress Count Table (ECT) based on hardware capabilities. The
bitmap sizes are calculated by dividing the total hardware entries by the
number of available ports.

> diff --git a/drivers/net/dsa/netc/netc_main.c b/drivers/net/dsa/netc/netc_main.c
> index fa7dd307ce130..d4475ad7ed6c2 100644
> --- a/drivers/net/dsa/netc/netc_main.c
> +++ b/drivers/net/dsa/netc/netc_main.c

[ ... ]

> +static int netc_init_ntmp_bitmap_sizes(struct netc_switch *priv)
> +{
> +	u32 num_ports = netc_num_available_ports(priv);
> +	struct netc_switch_regs *regs = &priv->regs;
> +	struct ntmp_user *ntmp = &priv->ntmp;
> +	u32 val;
> +
> +	if (!num_ports)
> +		return -EINVAL;
> +
> +	val = netc_base_rd(regs, NETC_ETTCAPR);
> +	ntmp->ett_bitmap_size = NETC_GET_NUM_ENTRIES(val) / num_ports;

[Severity: High]
Could calculating the bitmap size using the number of available ports lead to
out-of-bounds accesses by the hardware?

If any physical ports are disabled in the device tree, the available port
count will be strictly less than the hardware's actual physical port count.

When the hardware performs an egress lookup, it adds the physical port index
to the base ETT or ECT entry ID. Because the group size is compressed here
based only on available ports, it appears the hardware could access an entry
outside of the intended group. For the highest allocated group indices,
would this addition exceed the boundaries of the entire ETT/ECT table?

> +	if (!ntmp->ett_bitmap_size)
> +		return -EINVAL;
> +
> +	val = netc_base_rd(regs, NETC_ECTCAPR);
> +	ntmp->ect_bitmap_size = NETC_GET_NUM_ENTRIES(val) / num_ports;

[ ... ]

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260609032955.2066089-1-wei.fang@oss.nxp.com?part=5