Subject: Re: [PATCH] net/sun3_82586: Avoid reading past buffer in debug output

From: Simon Horman <[email-masked]>
Date: Thu, 8 Feb 2024 12:11:28 +0000

On Tue, Feb 06, 2024 at 08:16:54AM -0800, Kees Cook wrote:
> Since NUM_XMIT_BUFFS is always 1, building m68k with sun3_defconfig and
> -Warraybounds, this build warning is visible[1]:
> 
> drivers/net/ethernet/i825xx/sun3_82586.c: In function 'sun3_82586_timeout':
> drivers/net/ethernet/i825xx/sun3_82586.c:990:122: warning: array subscript 1 is above array bounds of 'volatile struct transmit_cmd_struct *[1]' [-Warray-bounds=]
>   990 |                 printk("%s: command-stats: %04x %04x\n",dev->name,swab16(p->xmit_cmds[0]->cmd_status),swab16(p->xmit_cmds[1]->cmd_status));
>       |                                                                                                               ~~~~~~~~~~~~^~~
> ...
> drivers/net/ethernet/i825xx/sun3_82586.c:156:46: note: while referencing 'xmit_cmds'
>   156 |         volatile struct transmit_cmd_struct *xmit_cmds[NUM_XMIT_BUFFS];
> 
> Avoid accessing index 1 since it doesn't exist.
> 
> Link: https://github.com/KSPP/linux/issues/325 [1]
> Cc: Sam Creasey <[email-masked]>
> Cc: "David S. Miller" <[email-masked]>
> Cc: Eric Dumazet <[email-masked]>
> Cc: Jakub Kicinski <[email-masked]>
> Cc: Paolo Abeni <[email-masked]>
> Cc: Gustavo A. R. Silva <[email-masked]>
> Cc: [email-masked]
> Signed-off-by: Kees Cook <[email-masked]>

Reviewed-by: Simon Horman <[email-masked]>
Tested-by: Simon Horman <[email-masked]> # build-tested

...