On August 18, 2021 9:05 AM -0300, Kees Cook wrote:

In preparation for FORTIFY_SOURCE performing compile-time and run-time field bounds checking for memset(), avoid intentionally writing across neighboring fields.

Use memset_startat() so memset() doesn't get confused about writing beyond the destination member that is intended to be the starting point of zeroing through the end of the struct.

The old code was doing the wrong thing: it starts from the second member and writes beyond int_info, clobbering qede_lock:

struct qede_dev { ... struct qed_int_info int_info;

    /* Smaller private variant of the RTNL lock */
    struct mutex                    qede_lock;

...

struct qed_int_info { struct msix_entry *msix; u8 msix_cnt;

    /* This should be updated by the protocol driver */
    u8                      used_cnt;

};

Cc: Ariel Elior aelior@marvell.com Cc: GR-everest-linux-l2@marvell.com Cc: "David S. Miller" davem@davemloft.net Cc: Jakub Kicinski kuba@kernel.org Cc: netdev@vger.kernel.org Signed-off-by: Kees Cook keescook@chromium.org

---

drivers/net/ethernet/qlogic/qede/qede_main.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/net/ethernet/qlogic/qede/qede_main.c b/drivers/net/ethernet/qlogic/qede/qede_main.c index d400e9b235bf..0ed9a0c8452c 100644 --- a/drivers/net/ethernet/qlogic/qede/qede_main.c +++ b/drivers/net/ethernet/qlogic/qede/qede_main.c @@ -2419,7 +2419,7 @@ static int qede_load(struct qede_dev *edev, enum qede_load_mode mode, goto out; err4: qede_sync_free_irqs(edev);

• memset(&edev->int_info.msix_cnt, 0, sizeof(struct qed_int_info));

• memset_startat(&edev->int_info, 0, msix_cnt);

As I commented on V1: "[PATCH 42/64] net: qede: Use memset_after() for counters", the memset is redundant and it should clear only the msix_cnt.

We will fix it.

err3: qede_napi_disable_remove(edev); err2: -- 2.30.2