[PATCH net] dpaa2-switch: validate num_ifs to prevent out-of-bounds write

[PATCH net] dpaa2-switch: validate num_ifs to prevent out-of-bounds write

[Junrui Luo]

The driver obtains sw_attr.num_ifs from firmware via dpsw_get_attributes()
but never validates it against DPSW_MAX_IF (64). This value controls
iteration in dpaa2_switch_fdb_get_flood_cfg(), which writes port indices
into the fixed-size cfg->if_id[DPSW_MAX_IF] array. When firmware reports
num_ifs >= 64, the loop can write past the array bounds.

Add a bound check for num_ifs in dpaa2_switch_init().

Reported-by: Yuhao Jiang <danisjiang@gmail.com>
Reported-by: Junrui Luo <moonafterrain@outlook.com>
Fixes: f054e3e217e4 ("dpaa2-switch: refactor the egress flooding domain setup")
Signed-off-by: Junrui Luo <moonafterrain@outlook.com>
---
 drivers/net/ethernet/freescale/dpaa2/dpaa2-switch.c | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/drivers/net/ethernet/freescale/dpaa2/dpaa2-switch.c b/drivers/net/ethernet/freescale/dpaa2/dpaa2-switch.c
index 66240c340492..78e21b46a5ba 100644
--- a/drivers/net/ethernet/freescale/dpaa2/dpaa2-switch.c
+++ b/drivers/net/ethernet/freescale/dpaa2/dpaa2-switch.c
@@ -3034,6 +3034,13 @@ static int dpaa2_switch_init(struct fsl_mc_device *sw_dev)
 		goto err_close;
 	}
 
+	if (ethsw->sw_attr.num_ifs >= DPSW_MAX_IF) {
+		dev_err(dev, "DPSW num_ifs %u exceeds max %u\n",
+			ethsw->sw_attr.num_ifs, DPSW_MAX_IF);
+		err = -EINVAL;
+		goto err_close;
+	}
+
 	err = dpsw_get_api_version(ethsw->mc_io, 0,
 				   &ethsw->major,
 				   &ethsw->minor);

---
base-commit: 9702969978695d9a699a1f34771580cdbb153b33
change-id: 20260217-fixes-32df5449b0ab

Best regards,
-- 
Junrui Luo <moonafterrain@outlook.com>

Re: [PATCH net] dpaa2-switch: validate num_ifs to prevent out-of-bounds write

[Jakub Kicinski]

On Tue, 17 Feb 2026 22:42:40 +0800 Junrui Luo wrote:
> The driver obtains sw_attr.num_ifs from firmware via dpsw_get_attributes()
> but never validates it against DPSW_MAX_IF (64). This value controls
> iteration in dpaa2_switch_fdb_get_flood_cfg(), which writes port indices
> into the fixed-size cfg->if_id[DPSW_MAX_IF] array. When firmware reports
> num_ifs >= 64, the loop can write past the array bounds.
> 
> Add a bound check for num_ifs in dpaa2_switch_init().
> 
> Reported-by: Yuhao Jiang <danisjiang@gmail.com>
> Reported-by: Junrui Luo <moonafterrain@outlook.com>

Please remove the self-referential reported-by tags. FWIW:
https://github.com/google/security-research/pull/334

> Fixes: f054e3e217e4 ("dpaa2-switch: refactor the egress flooding domain setup")

This commit looks like refactoring.
Please dig a bit deeper to find the real commit in which the bug was
added.

> Signed-off-by: Junrui Luo <moonafterrain@outlook.com>

> diff --git a/drivers/net/ethernet/freescale/dpaa2/dpaa2-switch.c b/drivers/net/ethernet/freescale/dpaa2/dpaa2-switch.c
> index 66240c340492..78e21b46a5ba 100644
> --- a/drivers/net/ethernet/freescale/dpaa2/dpaa2-switch.c
> +++ b/drivers/net/ethernet/freescale/dpaa2/dpaa2-switch.c
> @@ -3034,6 +3034,13 @@ static int dpaa2_switch_init(struct fsl_mc_device *sw_dev)
>  		goto err_close;
>  	}
>  
> +	if (ethsw->sw_attr.num_ifs >= DPSW_MAX_IF) {

Unclear to me from a quick look at the code and the commit message why
we reject num_ifs == DPSW_MAX_IF. I see there are some references to a
control interface in egress flooding, is that why?

Please explain clearly.
-- 
pw-bot: cr

Re: [PATCH net] dpaa2-switch: validate num_ifs to prevent out-of-bounds write

[Junrui Luo]

On Thu, Feb 19, 2026 at 02:14:07PM -0800, Jakub Kicinski wrote:
> > Reported-by: Yuhao Jiang <danisjiang@gmail.com>
> > Reported-by: Junrui Luo <moonafterrain@outlook.com>
> 
> Please remove the self-referential reported-by tags. FWIW:
> https://github.com/google/security-research/pull/334

Will drop in v2.

> 
> > Fixes: f054e3e217e4 ("dpaa2-switch: refactor the egress flooding domain setup")
> 
> This commit looks like refactoring.
> Please dig a bit deeper to find the real commit in which the bug was
> added.

I found the actual vulnerable pattern was introduced in:

539dda3c5d19 ("staging: dpaa2-switch: properly setup switching domains")

Will fix in v2.

> > +	if (ethsw->sw_attr.num_ifs >= DPSW_MAX_IF) {
> 
> Unclear to me from a quick look at the code and the commit message why
> we reject num_ifs == DPSW_MAX_IF. I see there are some references to a
> control interface in egress flooding, is that why?
> 
> Please explain clearly.

dpaa2_switch_fdb_get_flood_cfg() appends the control
interface entry after all matched ports:

      for (j = 0; j < ethsw->sw_attr.num_ifs; j++)
          if (port matches)
              cfg->if_id[i++] = ethsw->ports[j]->idx;

      cfg->if_id[i++] = ethsw->sw_attr.num_ifs;

When num_ifs == 64 and all ports match the flood filter, the loop
fills all 64 slots (indices 0-63), then the control interface write
goes to cfg->if_id[64].

Beyond the array overflow, num_ifs == 64 is also functionally broken:
build_if_id_bitmap() silently drops any ID >= 64:

      if (id[i] < DPSW_MAX_IF)
          bmap[id[i] / 64] |= ...

Will clarify this in the v2 commit message.

Thanks,
Junrui Luo