[PATCH] ice: bound field vector section count and base offset

[Noah Weinberger]

Hello,

ice_sw_fv_handler() validates the field-vector entry index only
against the package-supplied count, and computes the profile offset
from a package-supplied base_offset:

    if (index >= le16_to_cpu(fv_section->count))
        return NULL;
    if (offset)
        *offset = le16_to_cpu(fv_section->base_offset) + index;
    return fv_section->fv + index;

Neither count nor base_offset is checked against the section size
or ICE_MAX_NUM_PROFILES, and every consumer trusts the result:
set_bit((u16)offset, bm) into a stack bitmap in ice_add_adv_recipe()
(reached with CAP_NET_ADMIN ethtool/tc rules),
bitmap_zero(hw->switch_info->prof_res_bm[off], ...) which indexes
past the prof_res_bm[ICE_MAX_NUM_PROFILES] array, and the field-vector
reads themselves which can walk past the section end. A count of 1
with base_offset 0xfff0 in the package file is enough to reach the
single-bit stack write.

The patch bounds base_offset + count to ICE_MAX_NUM_PROFILES, which
bounds every offset consumer. (A full fix should additionally check
the section size against count * sizeof(struct ice_fv), which needs
the section length plumbed into the handler; this note is included
for the maintainers.)

Affected version/commit: mainline 8a65162514fbad21a2c58ffed65f42b27e92b163 (v7.4-rc2 window, 2026-11-08), drivers/net/ethernet/intel/ice/ice_ddp.c:343-360 (ice_sw_fv_handler: only index >= count is checked; count and base_offset never validated), :799 (set_bit((u16)offset, bm) in ice_get_sw_prof_type - offset up to base_offset+count), :914 and :924 (bitmap_zero(hw->switch_info->prof_res_bm[off], ...) with unbounded off; ice_type.h:780 declares prof_res_bm[ICE_MAX_NUM_PROFILES]), :846 (test_bit read), ice_flex_pipe.c:1995 (source memcpy), :2262-2264 (probe-time walk)
Longstanding parser; unchanged in the reviewed window.

This was found during an assisted (AI-supported) static source review of
mainline 8a65162514fbad21a2c58ffed65f42b27e92b163 (v7.4-rc2 window, 2026-11-08). The patch below has NOT been compiled and has
NOT been runtime tested, and no reproducer was produced - the triggering
conditions are described above instead. Please treat this as a report for
verification rather than a battle-tested fix.

---
diff --git a/drivers/net/ethernet/intel/ice/ice_ddp.c b/drivers/net/ethernet/intel/ice/ice_ddp.c
index 3b2d9c4369..2d9c99eddc 100644
--- a/drivers/net/ethernet/intel/ice/ice_ddp.c
+++ b/drivers/net/ethernet/intel/ice/ice_ddp.c
@@ -349,6 +349,12 @@ static void *ice_sw_fv_handler(u32 sect_type, void *section, u32 index,
 		return NULL;
 	if (index >= le16_to_cpu(fv_section->count))
 		return NULL;
+	/* count and base_offset come from the package file and index the
+	 * switch profile tables; bound them before use.
+	 */
+	if (le16_to_cpu(fv_section->base_offset) +
+	    le16_to_cpu(fv_section->count) > ICE_MAX_NUM_PROFILES)
+		return NULL;
 	if (offset)
 		/* "index" passed in to this function is relative to a given
 		 * 4k block. To get to the true index into the field vector