[lvc-project] [PATCH net v3 3/3] net: fealnx: bound card_idx to prevent out-of-bounds access

[Жамбакиев Радий Рикардинович]

From: Radiy Zhambakiev <r.zhambakiev at prosoftsystems.ru>

card_idx is a static counter that is incremented on every
probe. It can overflow and wrap to a negative value, which
then indexes options[] and full_duplex[] out of bounds.
Large values also no longer fit in the 12-byte boardname[]
buffer.

Bound card_idx to 99999, the largest value that still fits
into boardname, and fail the probe for any card beyond that.

fealnx is an old driver that cannot be tested properly on
real hardware, so a minimal best-effort guard was chosen
over a larger rework.

Found by Linux Verification Center (linuxtesting.org)

Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Cc: stable at vger.kernel.org
Signed-off-by: Radiy Zhambakiev <r.zhambakiev at prosoftsystems.ru>
---
 drivers/net/ethernet/fealnx.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/drivers/net/ethernet/fealnx.c b/drivers/net/ethernet/fealnx.c
index b5e96c7037f3..d5931c0314fc 100644
--- a/drivers/net/ethernet/fealnx.c
+++ b/drivers/net/ethernet/fealnx.c
@@ -41,6 +41,7 @@ static int rx_copybreak;
 /* interoperability.                                            */
 /* The media type is usually passed in 'options[]'.             */
 #define MAX_UNITS 8		/* More are supported, limit only on options */
+#define MAX_CARD_IDX		99999
 static int options[MAX_UNITS] = { -1, -1, -1, -1, -1, -1, -1, -1 };
 static int full_duplex[MAX_UNITS] = { -1, -1, -1, -1, -1, -1, -1, -1 };
 
@@ -489,6 +490,10 @@ static int fealnx_init_one(struct pci_dev *pdev,
 	int bar = 1;
 #endif
 
+	if (card_idx >= MAX_CARD_IDX) {
+		dev_err(&pdev->dev, "card_idx is too big %d, aborting", card_idx);
+		return -ENODEV;
+	}
 	card_idx++;
 	sprintf(boardname, "fealnx%d", card_idx);
 
-- 
2.53.0