* [PATCH] netxen: validate unified ROM directory bounds
@ 2026-07-06 9:37 Pengpeng Hou
2026-07-11 15:30 ` Simon Horman
2026-08-16 19:14 ` kernel test robot
0 siblings, 2 replies; 3+ messages in thread
From: Pengpeng Hou @ 2026-07-06 9:37 UTC (permalink / raw)
To: Manish Chopra
Cc: Pengpeng Hou, Rahul Verma, GR-Linux-NIC-Dev, Andrew Lunn,
David S. Miller, Eric Dumazet, Jakub Kicinski, Paolo Abeni,
netdev, linux-kernel
The unified ROM parser walks directory and data descriptor tables from
the firmware file. The existing checks compute table and data limits with
base + count * size or base + size before comparing with the firmware
size. Those calculations use fields from the firmware image and can wrap
before the comparison.
Add range helpers that validate tables and entries with division and
subtraction instead of overflowing additions. Pass the firmware size into
the directory lookup helper, validate each directory entry before reading
its type field, and validate bootloader, firmware and product-table
entries before their descriptor fields are used.
Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn>
---
.../ethernet/qlogic/netxen/netxen_nic_init.c | 148 +++++++++++-------
1 file changed, 90 insertions(+), 58 deletions(-)
diff --git a/drivers/net/ethernet/qlogic/netxen/netxen_nic_init.c b/drivers/net/ethernet/qlogic/netxen/netxen_nic_init.c
index 8bc4e2b69569..5722c55fa0cc 100644
--- a/drivers/net/ethernet/qlogic/netxen/netxen_nic_init.c
+++ b/drivers/net/ethernet/qlogic/netxen/netxen_nic_init.c
@@ -561,20 +561,55 @@ int netxen_pinit_from_rom(struct netxen_adapter *adapter)
return 0;
}
-static struct uni_table_desc *nx_get_table_desc(const u8 *unirom, int section)
+#define NX_UNI_DIR_TYPE_OFF 8
+#define NX_UNI_DIR_ENTRY_MIN_SIZE \
+ ((NX_UNI_DIR_TYPE_OFF + 1) * sizeof(u32))
+#define NX_UNI_PRODUCT_ENTRY_MIN_SIZE \
+ ((NX_UNI_FIRMWARE_IDX_OFF + 1) * sizeof(u32))
+
+static bool netxen_rom_range_valid(size_t size, u32 off, u32 len)
+{
+ return off <= size && len <= size - off;
+}
+
+static bool netxen_rom_table_valid(size_t size, u32 off, u32 n, u32 esz)
+{
+ if (off > size)
+ return false;
+ if (!esz)
+ return n == 0;
+
+ return n <= (size - off) / esz;
+}
+
+static bool netxen_rom_entry_valid(size_t size, u32 off, u32 esz, u32 idx)
+{
+ if (!esz || off > size)
+ return false;
+
+ return idx < (size - off) / esz;
+}
+
+static struct uni_table_desc *
+nx_get_table_desc(const u8 *unirom, size_t fw_size, int section)
{
- uint32_t i;
struct uni_table_desc *directory = (struct uni_table_desc *) &unirom[0];
- __le32 entries = cpu_to_le32(directory->num_entries);
+ u32 entries = cpu_to_le32(directory->num_entries);
+ u32 entry_size = cpu_to_le32(directory->entry_size);
+ u32 findex = cpu_to_le32(directory->findex);
+ u32 i;
- for (i = 0; i < entries; i++) {
+ if (entry_size < NX_UNI_DIR_ENTRY_MIN_SIZE ||
+ !netxen_rom_table_valid(fw_size, findex, entries, entry_size))
+ return NULL;
- __le32 offs = cpu_to_le32(directory->findex) +
- (i * cpu_to_le32(directory->entry_size));
- __le32 tab_type = cpu_to_le32(*((u32 *)&unirom[offs] + 8));
+ for (i = 0; i < entries; i++) {
+ size_t offs = findex + (size_t)i * entry_size;
+ u32 tab_type = cpu_to_le32(*((u32 *)&unirom[offs] +
+ NX_UNI_DIR_TYPE_OFF));
if (tab_type == section)
- return (struct uni_table_desc *) &unirom[offs];
+ return (struct uni_table_desc *)&unirom[offs];
}
return NULL;
@@ -586,20 +621,18 @@ static int
netxen_nic_validate_header(struct netxen_adapter *adapter)
{
const u8 *unirom = adapter->fw->data;
- struct uni_table_desc *directory = (struct uni_table_desc *) &unirom[0];
+ struct uni_table_desc *directory = (struct uni_table_desc *)&unirom[0];
u32 fw_file_size = adapter->fw->size;
- u32 tab_size;
- __le32 entries;
- __le32 entry_size;
+ u32 entries, entry_size, findex;
if (fw_file_size < QLCNIC_FILEHEADER_SIZE)
return -EINVAL;
entries = cpu_to_le32(directory->num_entries);
entry_size = cpu_to_le32(directory->entry_size);
- tab_size = cpu_to_le32(directory->findex) + (entries * entry_size);
+ findex = cpu_to_le32(directory->findex);
- if (fw_file_size < tab_size)
+ if (!netxen_rom_table_valid(fw_file_size, findex, entries, entry_size))
return -EINVAL;
return 0;
@@ -611,30 +644,30 @@ netxen_nic_validate_bootld(struct netxen_adapter *adapter)
struct uni_table_desc *tab_desc;
struct uni_data_desc *descr;
const u8 *unirom = adapter->fw->data;
- __le32 idx = cpu_to_le32(*((int *)&unirom[adapter->file_prd_off] +
- NX_UNI_BOOTLD_IDX_OFF));
- u32 offs;
- u32 tab_size;
- u32 data_size;
+ u32 data_len, data_off, entry_size, findex, idx;
+ u32 section = NX_UNI_DIR_SECT_BOOTLD;
+ size_t offs;
- tab_desc = nx_get_table_desc(unirom, NX_UNI_DIR_SECT_BOOTLD);
+ idx = cpu_to_le32(*((int *)&unirom[adapter->file_prd_off] +
+ NX_UNI_BOOTLD_IDX_OFF));
+ tab_desc = nx_get_table_desc(unirom, adapter->fw->size, section);
if (!tab_desc)
return -EINVAL;
- tab_size = cpu_to_le32(tab_desc->findex) +
- (cpu_to_le32(tab_desc->entry_size) * (idx + 1));
-
- if (adapter->fw->size < tab_size)
+ entry_size = cpu_to_le32(tab_desc->entry_size);
+ findex = cpu_to_le32(tab_desc->findex);
+ if (entry_size < sizeof(*descr) ||
+ !netxen_rom_entry_valid(adapter->fw->size, findex, entry_size,
+ idx))
return -EINVAL;
- offs = cpu_to_le32(tab_desc->findex) +
- (cpu_to_le32(tab_desc->entry_size) * (idx));
+ offs = findex + (size_t)entry_size * idx;
descr = (struct uni_data_desc *)&unirom[offs];
+ data_off = cpu_to_le32(descr->findex);
+ data_len = cpu_to_le32(descr->size);
- data_size = cpu_to_le32(descr->findex) + cpu_to_le32(descr->size);
-
- if (adapter->fw->size < data_size)
+ if (!netxen_rom_range_valid(adapter->fw->size, data_off, data_len))
return -EINVAL;
return 0;
@@ -646,29 +679,30 @@ netxen_nic_validate_fw(struct netxen_adapter *adapter)
struct uni_table_desc *tab_desc;
struct uni_data_desc *descr;
const u8 *unirom = adapter->fw->data;
- __le32 idx = cpu_to_le32(*((int *)&unirom[adapter->file_prd_off] +
- NX_UNI_FIRMWARE_IDX_OFF));
- u32 offs;
- u32 tab_size;
- u32 data_size;
+ u32 data_len, data_off, entry_size, findex, idx;
+ u32 section = NX_UNI_DIR_SECT_FW;
+ size_t offs;
- tab_desc = nx_get_table_desc(unirom, NX_UNI_DIR_SECT_FW);
+ idx = cpu_to_le32(*((int *)&unirom[adapter->file_prd_off] +
+ NX_UNI_FIRMWARE_IDX_OFF));
+ tab_desc = nx_get_table_desc(unirom, adapter->fw->size, section);
if (!tab_desc)
return -EINVAL;
- tab_size = cpu_to_le32(tab_desc->findex) +
- (cpu_to_le32(tab_desc->entry_size) * (idx + 1));
-
- if (adapter->fw->size < tab_size)
+ entry_size = cpu_to_le32(tab_desc->entry_size);
+ findex = cpu_to_le32(tab_desc->findex);
+ if (entry_size < sizeof(*descr) ||
+ !netxen_rom_entry_valid(adapter->fw->size, findex, entry_size,
+ idx))
return -EINVAL;
- offs = cpu_to_le32(tab_desc->findex) +
- (cpu_to_le32(tab_desc->entry_size) * (idx));
+ offs = findex + (size_t)entry_size * idx;
descr = (struct uni_data_desc *)&unirom[offs];
- data_size = cpu_to_le32(descr->findex) + cpu_to_le32(descr->size);
+ data_off = cpu_to_le32(descr->findex);
+ data_len = cpu_to_le32(descr->size);
- if (adapter->fw->size < data_size)
+ if (!netxen_rom_range_valid(adapter->fw->size, data_off, data_len))
return -EINVAL;
return 0;
@@ -682,39 +716,37 @@ netxen_nic_validate_product_offs(struct netxen_adapter *adapter)
const u8 *unirom = adapter->fw->data;
int mn_present = (NX_IS_REVISION_P2(adapter->ahw.revision_id)) ?
1 : netxen_p3_has_mn(adapter);
- __le32 entries;
- __le32 entry_size;
- u32 tab_size;
- u32 i;
+ u32 entries, entry_size, findex, i;
+ u32 section = NX_UNI_DIR_SECT_PRODUCT_TBL;
- ptab_descr = nx_get_table_desc(unirom, NX_UNI_DIR_SECT_PRODUCT_TBL);
+ ptab_descr = nx_get_table_desc(unirom, adapter->fw->size, section);
if (ptab_descr == NULL)
return -EINVAL;
entries = cpu_to_le32(ptab_descr->num_entries);
entry_size = cpu_to_le32(ptab_descr->entry_size);
- tab_size = cpu_to_le32(ptab_descr->findex) + (entries * entry_size);
-
- if (adapter->fw->size < tab_size)
+ findex = cpu_to_le32(ptab_descr->findex);
+ if (entry_size < NX_UNI_PRODUCT_ENTRY_MIN_SIZE ||
+ !netxen_rom_table_valid(adapter->fw->size, findex, entries,
+ entry_size))
return -EINVAL;
nomn:
for (i = 0; i < entries; i++) {
-
- __le32 flags, file_chiprev, offs;
+ size_t offs;
+ __le32 flags, file_chiprev;
u8 chiprev = adapter->ahw.revision_id;
uint32_t flagbit;
- offs = cpu_to_le32(ptab_descr->findex) +
- (i * cpu_to_le32(ptab_descr->entry_size));
+ offs = findex + (size_t)i * entry_size;
flags = cpu_to_le32(*((int *)&unirom[offs] + NX_UNI_FLAGS_OFF));
file_chiprev = cpu_to_le32(*((int *)&unirom[offs] +
- NX_UNI_CHIP_REV_OFF));
+ NX_UNI_CHIP_REV_OFF));
flagbit = mn_present ? 1 : 2;
if ((chiprev == file_chiprev) &&
- ((1ULL << flagbit) & flags)) {
+ ((1ULL << flagbit) & flags)) {
adapter->file_prd_off = offs;
return 0;
}
@@ -767,7 +799,7 @@ static struct uni_data_desc *nx_get_data_desc(struct netxen_adapter *adapter,
struct uni_table_desc *tab_desc;
__le32 offs;
- tab_desc = nx_get_table_desc(unirom, section);
+ tab_desc = nx_get_table_desc(unirom, adapter->fw->size, section);
if (tab_desc == NULL)
return NULL;
--
2.43.0
^ permalink raw reply related [flat|nested] 3+ messages in thread
* Re: [PATCH] netxen: validate unified ROM directory bounds
2026-07-06 9:37 [PATCH] netxen: validate unified ROM directory bounds Pengpeng Hou
@ 2026-07-11 15:30 ` Simon Horman
2026-08-16 19:14 ` kernel test robot
1 sibling, 0 replies; 3+ messages in thread
From: Simon Horman @ 2026-07-11 15:30 UTC (permalink / raw)
To: pengpeng
Cc: Simon Horman, manishc, rahulv, GR-Linux-NIC-Dev, andrew+netdev,
davem, edumazet, kuba, pabeni, netdev, linux-kernel
This is an AI-generated review of your patch. The human sending this
email has considered the AI review valid, or at least plausible.
Full review at: https://sashiko.dev
---
Subject: netxen: validate unified ROM directory bounds
This patch updates the unified ROM parser for the netxen driver to use safer
range validation helpers. It calculates bounds using division and subtraction
to avoid integer overflow vulnerabilities when validating directory entries,
bootloader, firmware, and product tables.
> diff --git a/drivers/net/ethernet/qlogic/netxen/netxen_nic_init.c b/drivers/net/ethernet/qlogic/netxen/netxen_nic_init.c
> index 8bc4e2b69569e..5722c55fa0cce 100644
> --- a/drivers/net/ethernet/qlogic/netxen/netxen_nic_init.c
> +++ b/drivers/net/ethernet/qlogic/netxen/netxen_nic_init.c
[ ... ]
> @@ -561,20 +561,55 @@ int netxen_pinit_from_rom(struct netxen_adapter *adapter)
[ ... ]
> +static struct uni_table_desc *
> +nx_get_table_desc(const u8 *unirom, size_t fw_size, int section)
> {
> struct uni_table_desc *directory = (struct uni_table_desc *) &unirom[0];
> - __le32 entries = cpu_to_le32(directory->num_entries);
> + u32 entries = cpu_to_le32(directory->num_entries);
> + u32 entry_size = cpu_to_le32(directory->entry_size);
> + u32 findex = cpu_to_le32(directory->findex);
> + u32 i;
>
> - for (i = 0; i < entries; i++) {
> + if (entry_size < NX_UNI_DIR_ENTRY_MIN_SIZE ||
> + !netxen_rom_table_valid(fw_size, findex, entries, entry_size))
> + return NULL;
>
> - __le32 offs = cpu_to_le32(directory->findex) +
> - (i * cpu_to_le32(directory->entry_size));
> - __le32 tab_type = cpu_to_le32(*((u32 *)&unirom[offs] + 8));
> + for (i = 0; i < entries; i++) {
> + size_t offs = findex + (size_t)i * entry_size;
> + u32 tab_type = cpu_to_le32(*((u32 *)&unirom[offs] +
> + NX_UNI_DIR_TYPE_OFF));
[Severity: High]
This isn't a bug introduced by this patch, but can this cast trigger an
unaligned access panic?
If findex or entry_size provided by the firmware header are unaligned,
offs will not be a multiple of 4. Casting &unirom[offs] directly to a
32-bit integer pointer and dereferencing it could fault on architectures that
do not support unaligned memory accesses natively.
>
> if (tab_type == section)
> - return (struct uni_table_desc *) &unirom[offs];
> + return (struct uni_table_desc *)&unirom[offs];
> }
>
> return NULL;
[ ... ]
> @@ -611,30 +644,30 @@ netxen_nic_validate_bootld(struct netxen_adapter *adapter)
[ ... ]
> - offs = cpu_to_le32(tab_desc->findex) +
> - (cpu_to_le32(tab_desc->entry_size) * (idx));
> + offs = findex + (size_t)entry_size * idx;
> descr = (struct uni_data_desc *)&unirom[offs];
> + data_off = cpu_to_le32(descr->findex);
> + data_len = cpu_to_le32(descr->size);
>
> - data_size = cpu_to_le32(descr->findex) + cpu_to_le32(descr->size);
> -
> - if (adapter->fw->size < data_size)
> + if (!netxen_rom_range_valid(adapter->fw->size, data_off, data_len))
> return -EINVAL;
[Severity: High]
This is a pre-existing issue, but does netxen_load_firmware() ignore this
validated data_len?
It appears netxen_load_firmware() uses a hardcoded copy size:
netxen_load_firmware() {
...
size = (NETXEN_IMAGE_START - NETXEN_BOOTLD_START) / 8;
ptr64 = (u64 *)nx_get_bootld_offs(adapter);
for (i = 0; i < size; i++) {
data = cpu_to_le64(ptr64[i]);
...
}
If data_len is small, couldn't this hardcoded size cause an out-of-bounds slab
memory read past the end of the firmware file data?
>
> return 0;
> @@ -646,29 +679,30 @@ netxen_nic_validate_fw(struct netxen_adapter *adapter)
[ ... ]
> - offs = cpu_to_le32(tab_desc->findex) +
> - (cpu_to_le32(tab_desc->entry_size) * (idx));
> + offs = findex + (size_t)entry_size * idx;
> descr = (struct uni_data_desc *)&unirom[offs];
> - data_size = cpu_to_le32(descr->findex) + cpu_to_le32(descr->size);
> + data_off = cpu_to_le32(descr->findex);
> + data_len = cpu_to_le32(descr->size);
>
> - if (adapter->fw->size < data_size)
> + if (!netxen_rom_range_valid(adapter->fw->size, data_off, data_len))
> return -EINVAL;
[Severity: High]
This is a pre-existing issue, but does this validation need to enforce a
minimum length for data_len (size)?
In nx_get_fw_version(), the version string pointer calculation relies on size:
nx_get_fw_version() {
...
ver_str = fw->data + cpu_to_le32(fw_data_desc->findex) +
cpu_to_le32(fw_data_desc->size) - 17;
for (i = 0; i < 12; i++) {
if (!strncmp(&ver_str[i], "REV=", 4)) {
...
}
If a malformed firmware image provides an entry where size is less than 17,
wouldn't the subtraction wrap around and result in a massive out-of-bounds
memory read?
Additionally, in netxen_load_firmware(), if the firmware data_len is not a
multiple of 8, it seems the remainder is handled unconditionally by reading a
full 8-byte word:
netxen_load_firmware() {
...
size = (__force u32)nx_get_fw_size(adapter) % 8;
if (size) {
data = cpu_to_le64(ptr64[i]);
...
}
If fw->size is exactly data_off + data_len, wouldn't reading an 8-byte chunk
at an unaligned remainder boundary access up to 7 bytes past the end of the
fw->data buffer?
>
> return 0;
> @@ -682,39 +716,37 @@ netxen_nic_validate_product_offs(struct netxen_adapter *adapter)
[ ... ]
> nomn:
> for (i = 0; i < entries; i++) {
> -
> - __le32 flags, file_chiprev, offs;
> + size_t offs;
> + __le32 flags, file_chiprev;
> u8 chiprev = adapter->ahw.revision_id;
> uint32_t flagbit;
>
> - offs = cpu_to_le32(ptab_descr->findex) +
> - (i * cpu_to_le32(ptab_descr->entry_size));
> + offs = findex + (size_t)i * entry_size;
> flags = cpu_to_le32(*((int *)&unirom[offs] + NX_UNI_FLAGS_OFF));
[Severity: High]
This isn't a bug introduced by this patch, but can this cast to (int *) also
trigger an unaligned access panic if the firmware supplies an unaligned
findex or entry_size?
> file_chiprev = cpu_to_le32(*((int *)&unirom[offs] +
> - NX_UNI_CHIP_REV_OFF));
> + NX_UNI_CHIP_REV_OFF));
>
> flagbit = mn_present ? 1 : 2;
>
--
pw-bot: changes-requested
^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: [PATCH] netxen: validate unified ROM directory bounds
2026-07-06 9:37 [PATCH] netxen: validate unified ROM directory bounds Pengpeng Hou
2026-07-11 15:30 ` Simon Horman
@ 2026-08-16 19:14 ` kernel test robot
1 sibling, 0 replies; 3+ messages in thread
From: kernel test robot @ 2026-08-16 19:14 UTC (permalink / raw)
To: Pengpeng Hou, Manish Chopra
Cc: oe-kbuild-all, Pengpeng Hou, Rahul Verma, GR-Linux-NIC-Dev,
Andrew Lunn, Eric Dumazet, Jakub Kicinski, Paolo Abeni, netdev,
linux-kernel
Hi Pengpeng,
kernel test robot noticed the following build warnings:
[auto build test WARNING on linus/master]
[also build test WARNING on v7.2-rc7 next-20260814]
[If your patch is applied to the wrong git tree, kindly drop us a note.
And when submitting patch, we suggest to use '--base' as documented in
https://git-scm.com/docs/git-format-patch#_base_tree_information]
url: https://github.com/intel-lab-lkp/linux/commits/Pengpeng-Hou/netxen-validate-unified-ROM-directory-bounds/20260813-084956
base: linus/master
patch link: https://lore.kernel.org/r/20260706093702.81687-1-pengpeng%40iscas.ac.cn
patch subject: [PATCH] netxen: validate unified ROM directory bounds
config: csky-randconfig-r122-20260816 (https://download.01.org/0day-ci/archive/20260817/202608170305.r8VtBUCF-lkp@intel.com/config)
compiler: csky-linux-gcc (GCC) 15.2.0
sparse: v0.6.5-rc1
reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20260817/202608170305.r8VtBUCF-lkp@intel.com/reproduce)
If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <lkp@intel.com>
| Closes: https://lore.kernel.org/oe-kbuild-all/202608170305.r8VtBUCF-lkp@intel.com/
sparse warnings: (new ones prefixed by >>)
>> drivers/net/ethernet/qlogic/netxen/netxen_nic_init.c:597:23: sparse: sparse: incorrect type in initializer (different base types) @@ expected unsigned int [usertype] entries @@ got restricted __le32 [usertype] @@
drivers/net/ethernet/qlogic/netxen/netxen_nic_init.c:597:23: sparse: expected unsigned int [usertype] entries
drivers/net/ethernet/qlogic/netxen/netxen_nic_init.c:597:23: sparse: got restricted __le32 [usertype]
>> drivers/net/ethernet/qlogic/netxen/netxen_nic_init.c:598:26: sparse: sparse: incorrect type in initializer (different base types) @@ expected unsigned int [usertype] entry_size @@ got restricted __le32 [usertype] @@
drivers/net/ethernet/qlogic/netxen/netxen_nic_init.c:598:26: sparse: expected unsigned int [usertype] entry_size
drivers/net/ethernet/qlogic/netxen/netxen_nic_init.c:598:26: sparse: got restricted __le32 [usertype]
>> drivers/net/ethernet/qlogic/netxen/netxen_nic_init.c:599:22: sparse: sparse: incorrect type in initializer (different base types) @@ expected unsigned int [usertype] findex @@ got restricted __le32 [usertype] @@
drivers/net/ethernet/qlogic/netxen/netxen_nic_init.c:599:22: sparse: expected unsigned int [usertype] findex
drivers/net/ethernet/qlogic/netxen/netxen_nic_init.c:599:22: sparse: got restricted __le32 [usertype]
>> drivers/net/ethernet/qlogic/netxen/netxen_nic_init.c:608:32: sparse: sparse: incorrect type in initializer (different base types) @@ expected unsigned int [usertype] tab_type @@ got restricted __le32 [usertype] @@
drivers/net/ethernet/qlogic/netxen/netxen_nic_init.c:608:32: sparse: expected unsigned int [usertype] tab_type
drivers/net/ethernet/qlogic/netxen/netxen_nic_init.c:608:32: sparse: got restricted __le32 [usertype]
>> drivers/net/ethernet/qlogic/netxen/netxen_nic_init.c:631:17: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned int [usertype] entries @@ got restricted __le32 [usertype] @@
drivers/net/ethernet/qlogic/netxen/netxen_nic_init.c:631:17: sparse: expected unsigned int [usertype] entries
drivers/net/ethernet/qlogic/netxen/netxen_nic_init.c:631:17: sparse: got restricted __le32 [usertype]
>> drivers/net/ethernet/qlogic/netxen/netxen_nic_init.c:632:20: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned int [usertype] entry_size @@ got restricted __le32 [usertype] @@
drivers/net/ethernet/qlogic/netxen/netxen_nic_init.c:632:20: sparse: expected unsigned int [usertype] entry_size
drivers/net/ethernet/qlogic/netxen/netxen_nic_init.c:632:20: sparse: got restricted __le32 [usertype]
>> drivers/net/ethernet/qlogic/netxen/netxen_nic_init.c:633:16: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned int [usertype] findex @@ got restricted __le32 [usertype] @@
drivers/net/ethernet/qlogic/netxen/netxen_nic_init.c:633:16: sparse: expected unsigned int [usertype] findex
drivers/net/ethernet/qlogic/netxen/netxen_nic_init.c:633:16: sparse: got restricted __le32 [usertype]
drivers/net/ethernet/qlogic/netxen/netxen_nic_init.c:651:15: sparse: sparse: restricted __le32 degrades to integer
>> drivers/net/ethernet/qlogic/netxen/netxen_nic_init.c:651:13: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned int [usertype] idx @@ got restricted __le32 [usertype] @@
drivers/net/ethernet/qlogic/netxen/netxen_nic_init.c:651:13: sparse: expected unsigned int [usertype] idx
drivers/net/ethernet/qlogic/netxen/netxen_nic_init.c:651:13: sparse: got restricted __le32 [usertype]
drivers/net/ethernet/qlogic/netxen/netxen_nic_init.c:658:20: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned int [usertype] entry_size @@ got restricted __le32 [usertype] @@
drivers/net/ethernet/qlogic/netxen/netxen_nic_init.c:658:20: sparse: expected unsigned int [usertype] entry_size
drivers/net/ethernet/qlogic/netxen/netxen_nic_init.c:658:20: sparse: got restricted __le32 [usertype]
drivers/net/ethernet/qlogic/netxen/netxen_nic_init.c:659:16: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned int [usertype] findex @@ got restricted __le32 [usertype] @@
drivers/net/ethernet/qlogic/netxen/netxen_nic_init.c:659:16: sparse: expected unsigned int [usertype] findex
drivers/net/ethernet/qlogic/netxen/netxen_nic_init.c:659:16: sparse: got restricted __le32 [usertype]
>> drivers/net/ethernet/qlogic/netxen/netxen_nic_init.c:667:18: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned int [usertype] data_off @@ got restricted __le32 [usertype] @@
drivers/net/ethernet/qlogic/netxen/netxen_nic_init.c:667:18: sparse: expected unsigned int [usertype] data_off
drivers/net/ethernet/qlogic/netxen/netxen_nic_init.c:667:18: sparse: got restricted __le32 [usertype]
>> drivers/net/ethernet/qlogic/netxen/netxen_nic_init.c:668:18: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned int [usertype] data_len @@ got restricted __le32 [usertype] @@
drivers/net/ethernet/qlogic/netxen/netxen_nic_init.c:668:18: sparse: expected unsigned int [usertype] data_len
drivers/net/ethernet/qlogic/netxen/netxen_nic_init.c:668:18: sparse: got restricted __le32 [usertype]
drivers/net/ethernet/qlogic/netxen/netxen_nic_init.c:686:15: sparse: sparse: restricted __le32 degrades to integer
drivers/net/ethernet/qlogic/netxen/netxen_nic_init.c:686:13: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned int [usertype] idx @@ got restricted __le32 [usertype] @@
drivers/net/ethernet/qlogic/netxen/netxen_nic_init.c:686:13: sparse: expected unsigned int [usertype] idx
drivers/net/ethernet/qlogic/netxen/netxen_nic_init.c:686:13: sparse: got restricted __le32 [usertype]
drivers/net/ethernet/qlogic/netxen/netxen_nic_init.c:693:20: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned int [usertype] entry_size @@ got restricted __le32 [usertype] @@
drivers/net/ethernet/qlogic/netxen/netxen_nic_init.c:693:20: sparse: expected unsigned int [usertype] entry_size
drivers/net/ethernet/qlogic/netxen/netxen_nic_init.c:693:20: sparse: got restricted __le32 [usertype]
drivers/net/ethernet/qlogic/netxen/netxen_nic_init.c:694:16: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned int [usertype] findex @@ got restricted __le32 [usertype] @@
drivers/net/ethernet/qlogic/netxen/netxen_nic_init.c:694:16: sparse: expected unsigned int [usertype] findex
drivers/net/ethernet/qlogic/netxen/netxen_nic_init.c:694:16: sparse: got restricted __le32 [usertype]
drivers/net/ethernet/qlogic/netxen/netxen_nic_init.c:702:18: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned int [usertype] data_off @@ got restricted __le32 [usertype] @@
drivers/net/ethernet/qlogic/netxen/netxen_nic_init.c:702:18: sparse: expected unsigned int [usertype] data_off
drivers/net/ethernet/qlogic/netxen/netxen_nic_init.c:702:18: sparse: got restricted __le32 [usertype]
drivers/net/ethernet/qlogic/netxen/netxen_nic_init.c:703:18: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned int [usertype] data_len @@ got restricted __le32 [usertype] @@
drivers/net/ethernet/qlogic/netxen/netxen_nic_init.c:703:18: sparse: expected unsigned int [usertype] data_len
drivers/net/ethernet/qlogic/netxen/netxen_nic_init.c:703:18: sparse: got restricted __le32 [usertype]
drivers/net/ethernet/qlogic/netxen/netxen_nic_init.c:726:17: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned int [usertype] entries @@ got restricted __le32 [usertype] @@
drivers/net/ethernet/qlogic/netxen/netxen_nic_init.c:726:17: sparse: expected unsigned int [usertype] entries
drivers/net/ethernet/qlogic/netxen/netxen_nic_init.c:726:17: sparse: got restricted __le32 [usertype]
drivers/net/ethernet/qlogic/netxen/netxen_nic_init.c:727:20: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned int [usertype] entry_size @@ got restricted __le32 [usertype] @@
drivers/net/ethernet/qlogic/netxen/netxen_nic_init.c:727:20: sparse: expected unsigned int [usertype] entry_size
drivers/net/ethernet/qlogic/netxen/netxen_nic_init.c:727:20: sparse: got restricted __le32 [usertype]
drivers/net/ethernet/qlogic/netxen/netxen_nic_init.c:728:16: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned int [usertype] findex @@ got restricted __le32 [usertype] @@
drivers/net/ethernet/qlogic/netxen/netxen_nic_init.c:728:16: sparse: expected unsigned int [usertype] findex
drivers/net/ethernet/qlogic/netxen/netxen_nic_init.c:728:16: sparse: got restricted __le32 [usertype]
drivers/net/ethernet/qlogic/netxen/netxen_nic_init.c:748:33: sparse: sparse: restricted __le32 degrades to integer
drivers/net/ethernet/qlogic/netxen/netxen_nic_init.c:749:42: sparse: sparse: restricted __le32 degrades to integer
>> drivers/net/ethernet/qlogic/netxen/netxen_nic_init.c:750:47: sparse: sparse: incorrect type in assignment (different base types) @@ expected restricted __le32 [usertype] file_prd_off @@ got unsigned int [assigned] [usertype] offs @@
drivers/net/ethernet/qlogic/netxen/netxen_nic_init.c:750:47: sparse: expected restricted __le32 [usertype] file_prd_off
drivers/net/ethernet/qlogic/netxen/netxen_nic_init.c:750:47: sparse: got unsigned int [assigned] [usertype] offs
drivers/net/ethernet/qlogic/netxen/netxen_nic_init.c:797:19: sparse: sparse: restricted __le32 degrades to integer
drivers/net/ethernet/qlogic/netxen/netxen_nic_init.c:797:19: sparse: sparse: incorrect type in initializer (different base types) @@ expected int idx @@ got restricted __le32 [usertype] @@
drivers/net/ethernet/qlogic/netxen/netxen_nic_init.c:797:19: sparse: expected int idx
drivers/net/ethernet/qlogic/netxen/netxen_nic_init.c:797:19: sparse: got restricted __le32 [usertype]
drivers/net/ethernet/qlogic/netxen/netxen_nic_init.c:808:26: sparse: sparse: restricted __le32 degrades to integer
drivers/net/ethernet/qlogic/netxen/netxen_nic_init.c:807:16: sparse: sparse: restricted __le32 degrades to integer
drivers/net/ethernet/qlogic/netxen/netxen_nic_init.c:807:14: sparse: sparse: incorrect type in assignment (different base types) @@ expected restricted __le32 [usertype] offs @@ got unsigned int @@
drivers/net/ethernet/qlogic/netxen/netxen_nic_init.c:807:14: sparse: expected restricted __le32 [usertype] offs
drivers/net/ethernet/qlogic/netxen/netxen_nic_init.c:807:14: sparse: got unsigned int
drivers/net/ethernet/qlogic/netxen/netxen_nic_init.c:810:48: sparse: sparse: restricted __le32 degrades to integer
drivers/net/ethernet/qlogic/netxen/netxen_nic_init.c:819:22: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned int [usertype] offs @@ got restricted __le32 [usertype] @@
drivers/net/ethernet/qlogic/netxen/netxen_nic_init.c:819:22: sparse: expected unsigned int [usertype] offs
drivers/net/ethernet/qlogic/netxen/netxen_nic_init.c:819:22: sparse: got restricted __le32 [usertype]
drivers/net/ethernet/qlogic/netxen/netxen_nic_init.c:832:22: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned int [usertype] offs @@ got restricted __le32 [usertype] @@
drivers/net/ethernet/qlogic/netxen/netxen_nic_init.c:832:22: sparse: expected unsigned int [usertype] offs
drivers/net/ethernet/qlogic/netxen/netxen_nic_init.c:832:22: sparse: got restricted __le32 [usertype]
drivers/net/ethernet/qlogic/netxen/netxen_nic_init.c:864:38: sparse: sparse: restricted __le32 degrades to integer
drivers/net/ethernet/qlogic/netxen/netxen_nic_init.c:865:33: sparse: sparse: restricted __le32 degrades to integer
drivers/net/ethernet/qlogic/netxen/netxen_nic_init.c:878:33: sparse: sparse: restricted __le32 degrades to integer
drivers/net/ethernet/qlogic/netxen/netxen_nic_init.c:878:24: sparse: sparse: restricted __le32 degrades to integer
drivers/net/ethernet/qlogic/netxen/netxen_nic_init.c:878:48: sparse: sparse: restricted __le32 degrades to integer
drivers/net/ethernet/qlogic/netxen/netxen_nic_init.c:878:45: sparse: sparse: incorrect type in return expression (different base types) @@ expected restricted __le32 @@ got unsigned int @@
drivers/net/ethernet/qlogic/netxen/netxen_nic_init.c:878:45: sparse: expected restricted __le32
drivers/net/ethernet/qlogic/netxen/netxen_nic_init.c:878:45: sparse: got unsigned int
drivers/net/ethernet/qlogic/netxen/netxen_nic_init.c:891:28: sparse: sparse: restricted __le32 degrades to integer
drivers/net/ethernet/qlogic/netxen/netxen_nic_init.c:893:25: sparse: sparse: restricted __le32 degrades to integer
drivers/net/ethernet/qlogic/netxen/netxen_nic_init.c:893:45: sparse: sparse: restricted __le32 degrades to integer
drivers/net/ethernet/qlogic/netxen/netxen_nic_init.c:894:58: sparse: sparse: restricted __le32 degrades to integer
drivers/net/ethernet/qlogic/netxen/netxen_nic_init.c:893:70: sparse: sparse: incorrect type in return expression (different base types) @@ expected restricted __le32 @@ got unsigned int @@
drivers/net/ethernet/qlogic/netxen/netxen_nic_init.c:893:70: sparse: expected restricted __le32
drivers/net/ethernet/qlogic/netxen/netxen_nic_init.c:893:70: sparse: got unsigned int
drivers/net/ethernet/qlogic/netxen/netxen_nic_init.c:942:21: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned int [usertype] val @@ got restricted __le32 @@
drivers/net/ethernet/qlogic/netxen/netxen_nic_init.c:942:21: sparse: expected unsigned int [usertype] val
drivers/net/ethernet/qlogic/netxen/netxen_nic_init.c:942:21: sparse: got restricted __le32
drivers/net/ethernet/qlogic/netxen/netxen_nic_init.c:1030:72: sparse: sparse: incorrect type in argument 3 (different base types) @@ expected unsigned long long [usertype] @@ got restricted __le64 [assigned] [usertype] data @@
drivers/net/ethernet/qlogic/netxen/netxen_nic_init.c:1030:72: sparse: expected unsigned long long [usertype]
drivers/net/ethernet/qlogic/netxen/netxen_nic_init.c:1030:72: sparse: got restricted __le64 [assigned] [usertype] data
drivers/net/ethernet/qlogic/netxen/netxen_nic_init.c:1045:60: sparse: sparse: incorrect type in argument 3 (different base types) @@ expected unsigned long long [usertype] @@ got restricted __le64 [assigned] [usertype] data @@
drivers/net/ethernet/qlogic/netxen/netxen_nic_init.c:1045:60: sparse: expected unsigned long long [usertype]
drivers/net/ethernet/qlogic/netxen/netxen_nic_init.c:1045:60: sparse: got restricted __le64 [assigned] [usertype] data
drivers/net/ethernet/qlogic/netxen/netxen_nic_init.c:1056:60: sparse: sparse: incorrect type in argument 3 (different base types) @@ expected unsigned long long [usertype] @@ got restricted __le64 [assigned] [usertype] data @@
drivers/net/ethernet/qlogic/netxen/netxen_nic_init.c:1056:60: sparse: expected unsigned long long [usertype]
drivers/net/ethernet/qlogic/netxen/netxen_nic_init.c:1056:60: sparse: got restricted __le64 [assigned] [usertype] data
drivers/net/ethernet/qlogic/netxen/netxen_nic_init.c:1130:23: sparse: sparse: restricted __le32 degrades to integer
drivers/net/ethernet/qlogic/netxen/netxen_nic_init.c:1130:23: sparse: sparse: restricted __le32 degrades to integer
drivers/net/ethernet/qlogic/netxen/netxen_nic_init.c:1130:23: sparse: sparse: restricted __le32 degrades to integer
drivers/net/ethernet/qlogic/netxen/netxen_nic_init.c:1154:24: sparse: sparse: restricted __le32 degrades to integer
drivers/net/ethernet/qlogic/netxen/netxen_nic_init.c:1154:24: sparse: sparse: restricted __le32 degrades to integer
drivers/net/ethernet/qlogic/netxen/netxen_nic_init.c:1154:24: sparse: sparse: restricted __le32 degrades to integer
drivers/net/ethernet/qlogic/netxen/netxen_nic_init.c:1154:22: sparse: sparse: incorrect type in assignment (different base types) @@ expected restricted __le32 [addressable] [usertype] flash_fw_ver @@ got unsigned int @@
drivers/net/ethernet/qlogic/netxen/netxen_nic_init.c:1154:22: sparse: expected restricted __le32 [addressable] [usertype] flash_fw_ver
drivers/net/ethernet/qlogic/netxen/netxen_nic_init.c:1154:22: sparse: got unsigned int
drivers/net/ethernet/qlogic/netxen/netxen_nic_init.c:1158:46: sparse: sparse: restricted __le32 degrades to integer
drivers/net/ethernet/qlogic/netxen/netxen_nic_init.c:1170:21: sparse: sparse: restricted __le32 degrades to integer
vim +597 drivers/net/ethernet/qlogic/netxen/netxen_nic_init.c
592
593 static struct uni_table_desc *
594 nx_get_table_desc(const u8 *unirom, size_t fw_size, int section)
595 {
596 struct uni_table_desc *directory = (struct uni_table_desc *) &unirom[0];
> 597 u32 entries = cpu_to_le32(directory->num_entries);
> 598 u32 entry_size = cpu_to_le32(directory->entry_size);
> 599 u32 findex = cpu_to_le32(directory->findex);
600 u32 i;
601
602 if (entry_size < NX_UNI_DIR_ENTRY_MIN_SIZE ||
603 !netxen_rom_table_valid(fw_size, findex, entries, entry_size))
604 return NULL;
605
606 for (i = 0; i < entries; i++) {
607 size_t offs = findex + (size_t)i * entry_size;
> 608 u32 tab_type = cpu_to_le32(*((u32 *)&unirom[offs] +
609 NX_UNI_DIR_TYPE_OFF));
610
611 if (tab_type == section)
612 return (struct uni_table_desc *)&unirom[offs];
613 }
614
615 return NULL;
616 }
617
618 #define QLCNIC_FILEHEADER_SIZE (14 * 4)
619
620 static int
621 netxen_nic_validate_header(struct netxen_adapter *adapter)
622 {
623 const u8 *unirom = adapter->fw->data;
624 struct uni_table_desc *directory = (struct uni_table_desc *)&unirom[0];
625 u32 fw_file_size = adapter->fw->size;
626 u32 entries, entry_size, findex;
627
628 if (fw_file_size < QLCNIC_FILEHEADER_SIZE)
629 return -EINVAL;
630
> 631 entries = cpu_to_le32(directory->num_entries);
> 632 entry_size = cpu_to_le32(directory->entry_size);
> 633 findex = cpu_to_le32(directory->findex);
634
635 if (!netxen_rom_table_valid(fw_file_size, findex, entries, entry_size))
636 return -EINVAL;
637
638 return 0;
639 }
640
641 static int
642 netxen_nic_validate_bootld(struct netxen_adapter *adapter)
643 {
644 struct uni_table_desc *tab_desc;
645 struct uni_data_desc *descr;
646 const u8 *unirom = adapter->fw->data;
647 u32 data_len, data_off, entry_size, findex, idx;
648 u32 section = NX_UNI_DIR_SECT_BOOTLD;
649 size_t offs;
650
> 651 idx = cpu_to_le32(*((int *)&unirom[adapter->file_prd_off] +
652 NX_UNI_BOOTLD_IDX_OFF));
653 tab_desc = nx_get_table_desc(unirom, adapter->fw->size, section);
654
655 if (!tab_desc)
656 return -EINVAL;
657
658 entry_size = cpu_to_le32(tab_desc->entry_size);
659 findex = cpu_to_le32(tab_desc->findex);
660 if (entry_size < sizeof(*descr) ||
661 !netxen_rom_entry_valid(adapter->fw->size, findex, entry_size,
662 idx))
663 return -EINVAL;
664
665 offs = findex + (size_t)entry_size * idx;
666 descr = (struct uni_data_desc *)&unirom[offs];
> 667 data_off = cpu_to_le32(descr->findex);
> 668 data_len = cpu_to_le32(descr->size);
669
670 if (!netxen_rom_range_valid(adapter->fw->size, data_off, data_len))
671 return -EINVAL;
672
673 return 0;
674 }
675
676 static int
677 netxen_nic_validate_fw(struct netxen_adapter *adapter)
678 {
679 struct uni_table_desc *tab_desc;
680 struct uni_data_desc *descr;
681 const u8 *unirom = adapter->fw->data;
682 u32 data_len, data_off, entry_size, findex, idx;
683 u32 section = NX_UNI_DIR_SECT_FW;
684 size_t offs;
685
686 idx = cpu_to_le32(*((int *)&unirom[adapter->file_prd_off] +
687 NX_UNI_FIRMWARE_IDX_OFF));
688 tab_desc = nx_get_table_desc(unirom, adapter->fw->size, section);
689
690 if (!tab_desc)
691 return -EINVAL;
692
693 entry_size = cpu_to_le32(tab_desc->entry_size);
694 findex = cpu_to_le32(tab_desc->findex);
695 if (entry_size < sizeof(*descr) ||
696 !netxen_rom_entry_valid(adapter->fw->size, findex, entry_size,
697 idx))
698 return -EINVAL;
699
700 offs = findex + (size_t)entry_size * idx;
701 descr = (struct uni_data_desc *)&unirom[offs];
702 data_off = cpu_to_le32(descr->findex);
703 data_len = cpu_to_le32(descr->size);
704
705 if (!netxen_rom_range_valid(adapter->fw->size, data_off, data_len))
706 return -EINVAL;
707
708 return 0;
709 }
710
711
712 static int
713 netxen_nic_validate_product_offs(struct netxen_adapter *adapter)
714 {
715 struct uni_table_desc *ptab_descr;
716 const u8 *unirom = adapter->fw->data;
717 int mn_present = (NX_IS_REVISION_P2(adapter->ahw.revision_id)) ?
718 1 : netxen_p3_has_mn(adapter);
719 u32 entries, entry_size, findex, i;
720 u32 section = NX_UNI_DIR_SECT_PRODUCT_TBL;
721
722 ptab_descr = nx_get_table_desc(unirom, adapter->fw->size, section);
723 if (ptab_descr == NULL)
724 return -EINVAL;
725
726 entries = cpu_to_le32(ptab_descr->num_entries);
727 entry_size = cpu_to_le32(ptab_descr->entry_size);
728 findex = cpu_to_le32(ptab_descr->findex);
729 if (entry_size < NX_UNI_PRODUCT_ENTRY_MIN_SIZE ||
730 !netxen_rom_table_valid(adapter->fw->size, findex, entries,
731 entry_size))
732 return -EINVAL;
733
734 nomn:
735 for (i = 0; i < entries; i++) {
736 size_t offs;
737 __le32 flags, file_chiprev;
738 u8 chiprev = adapter->ahw.revision_id;
739 uint32_t flagbit;
740
741 offs = findex + (size_t)i * entry_size;
742 flags = cpu_to_le32(*((int *)&unirom[offs] + NX_UNI_FLAGS_OFF));
743 file_chiprev = cpu_to_le32(*((int *)&unirom[offs] +
744 NX_UNI_CHIP_REV_OFF));
745
746 flagbit = mn_present ? 1 : 2;
747
748 if ((chiprev == file_chiprev) &&
749 ((1ULL << flagbit) & flags)) {
> 750 adapter->file_prd_off = offs;
751 return 0;
752 }
753 }
754
755 if (mn_present && NX_IS_REVISION_P3(adapter->ahw.revision_id)) {
756 mn_present = 0;
757 goto nomn;
758 }
759
760 return -EINVAL;
761 }
762
--
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2026-08-16 19:14 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-07-06 9:37 [PATCH] netxen: validate unified ROM directory bounds Pengpeng Hou
2026-07-11 15:30 ` Simon Horman
2026-08-16 19:14 ` kernel test robot
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox