[lvc-project] [PATCH net v3 3/3] net: fealnx: bound card_idx to prevent out-of-bounds access

[Andrew Lunn]

On Mon, Oct 19, 2026 at 01:43:03PM +0000, Жамбакиев Радий Рикардинович wrote:
> From: Radiy Zhambakiev <r.zhambakiev at prosoftsystems.ru>
> 
> card_idx is a static counter that is incremented on every
> probe. It can overflow and wrap to a negative value, which
> then indexes options[] and full_duplex[] out of bounds.
> Large values also no longer fit in the 12-byte boardname[]
> buffer.
> 
> Bound card_idx to 99999, the largest value that still fits
> into boardname, and fail the probe for any card beyond that.
> 
> fealnx is an old driver that cannot be tested properly on
> real hardware, so a minimal best-effort guard was chosen
> over a larger rework.
> 
> Found by Linux Verification Center (linuxtesting.org)
> 
> Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
> Cc: stable at vger.kernel.org
> Signed-off-by: Radiy Zhambakiev <r.zhambakiev at prosoftsystems.ru>

Please drop the Fixes: when you repost to net-next. This is one of
those theoretical fixes which never happens and nobody cares about, so
there is no need to backport it to stable.

Reviewed-by: Andrew Lunn <andrew at lunn.ch>

    Andrew