[lvc-project] [PATCH net v3 3/3] net: fealnx: bound card_idx to prevent out-of-bounds access

[Loktionov, Aleksandr]

> -----Original Message-----
> From: Жамбакиев Радий Рикардинович <r.zhambakiev at prosoftsystems.ru>
> Sent: Monday, October 19, 2026 3:43 PM
> To: Andrew Lunn <andrew+netdev at lunn.ch>
> Cc: Жамбакиев Радий Рикардинович <r.zhambakiev at prosoftsystems.ru>; David
> S. Miller <davem at davemloft.net>; Eric Dumazet <edumazet at google.com>;
> Jakub Kicinski <kuba at kernel.org>; Paolo Abeni <pabeni at redhat.com>;
> Michael Grzeschik <mgr at kernel.org>; Jijie Shao <shaojijie at huawei.com>;
> Loktionov, Aleksandr <aleksandr.loktionov at intel.com>; Denis Benato
> <benato.denis96 at gmail.com>; Uwe Kleine-König (The Capable Hub)
> <u.kleine-koenig at baylibre.com>; netdev at vger.kernel.org; linux-
> kernel at vger.kernel.org; lvc-project at linuxtesting.org;
> stable at vger.kernel.org
> Subject: [PATCH net v3 3/3] net: fealnx: bound card_idx to prevent out-
> of-bounds access
> 
> From: Radiy Zhambakiev <r.zhambakiev at prosoftsystems.ru>
> 
> card_idx is a static counter that is incremented on every probe. It can
> overflow and wrap to a negative value, which then indexes options[] and
> full_duplex[] out of bounds.
> Large values also no longer fit in the 12-byte boardname[] buffer.
> 
> Bound card_idx to 99999, the largest value that still fits into
> boardname, and fail the probe for any card beyond that.
> 
> fealnx is an old driver that cannot be tested properly on real hardware,
> so a minimal best-effort guard was chosen over a larger rework.
> 
> Found by Linux Verification Center (linuxtesting.org)
> 
> Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
> Cc: stable at vger.kernel.org
> Signed-off-by: Radiy Zhambakiev <r.zhambakiev at prosoftsystems.ru>
> ---
>  drivers/net/ethernet/fealnx.c | 5 +++++
>  1 file changed, 5 insertions(+)
> 
> diff --git a/drivers/net/ethernet/fealnx.c
> b/drivers/net/ethernet/fealnx.c index b5e96c7037f3..d5931c0314fc 100644
> --- a/drivers/net/ethernet/fealnx.c
> +++ b/drivers/net/ethernet/fealnx.c
> @@ -41,6 +41,7 @@ static int rx_copybreak;
>  /* interoperability.                                            */
>  /* The media type is usually passed in 'options[]'.             */
>  #define MAX_UNITS 8		/* More are supported, limit only on options
> */
> +#define MAX_CARD_IDX		99999
>  static int options[MAX_UNITS] = { -1, -1, -1, -1, -1, -1, -1, -1 };
> static int full_duplex[MAX_UNITS] = { -1, -1, -1, -1, -1, -1, -1, -1 };
> 
> @@ -489,6 +490,10 @@ static int fealnx_init_one(struct pci_dev *pdev,
>  	int bar = 1;
>  #endif
> 
> +	if (card_idx >= MAX_CARD_IDX) {
> +		dev_err(&pdev->dev, "card_idx is too big %d, aborting",
> card_idx);
> +		return -ENODEV;
> +	}
>  	card_idx++;
card_idx can reach 100000 is it ok? 

>  	sprintf(boardname, "fealnx%d", card_idx);
> 
> --
> 2.53.0