On Mon, Apr 07, 2025 at 03:51:10PM -0700, Shannon Nelson wrote:
From: Brett Creeley <brett.creeley@xxxxxxx>
If the FW doesn't support the PDS_CORE_CMD_FW_CONTROL command
the driver might at the least print garbage and at the worst
crash when the user runs the "devlink dev info" devlink command.
This happens because the stack variable fw_list is not 0
initialized which results in fw_list.num_fw_slots being a
garbage value from the stack. Then the driver tries to access
fw_list.fw_names[i] with i >= ARRAY_SIZE and runs off the end
of the array.
Fix this by initializing the fw_list and adding an ARRAY_SIZE
limiter to the loop, and by not failing completely if the
devcmd fails because other useful information is printed via
devlink dev info even if the devcmd fails.
Hi Brett, and Shannon,
It looks like the ARRAY_SIZE limiter on the loop exists since
commit 8c817eb26230 ("pds_core: limit loop over fw name list").
And, if so, I think the patch description should be reworked a bit.
Fixes: 45d76f492938 ("pds_core: set up device and adminq")
Signed-off-by: Brett Creeley <brett.creeley@xxxxxxx>
Signed-off-by: Shannon Nelson <shannon.nelson@xxxxxxx>
...