Re: [PATCH net 0/2] forcedeth: two register-window bounds fixes
| Newsgroups | org.kernel.vger.netdev,org.kernel.vger.linux-kernel |
|---|---|
| Message-ID | <178725423663.446762.8387913060215636639.git-patchwork-notify@kernel.org> |
Hello: This series was applied to netdev/net.git (main) by Jakub Kicinski <[email protected]>: On Sat, 15 Aug 2026 21:54:38 +0200 you wrote: > From: Marek Czernohous <[email protected]> > > Two bounds fixes in forcedeth, both in the same shape: a loop that walks > the register window one step too far. They are independent of each other > and touch different functions. > > 1/2 nv_suspend() and nv_resume() save and restore the non-PCI config > space with i <= register_size/sizeof(u32). On a VER3 device that is > exactly the length of saved_config_space[], so the last iteration > reads and writes one element past the array, and on resume it > writel()s that element one dword past the length the driver mapped. > UBSAN catches it. > > [...] Here is the summary with links: - [net,1/2] forcedeth: fix off-by-one when saving/restoring non-PCI config space https://git.kernel.org/netdev/net/c/9393f1d656a7 - [net,2/2] forcedeth: stop the tx_timeout register dump past the requested window https://git.kernel.org/netdev/net/c/cfa9178ce2e5 You are awesome, thank you! -- Deet-doot-dot, I am a bot. https://korg.docs.kernel.org/patchwork/pwbot.html