[PATCH net] octeontx2-af: fix out-of-bounds read setting MSI-X irq affinity

[PATCH net] octeontx2-af: fix out-of-bounds read setting MSI-X irq affinity

[Ratheesh Kannoth]

From: Anshumali Gaur <agaur@marvell.com>

rvu_register_interrupts() walks every MSI-X vector and uses strstr()
to match "Mbox" or "FLR" in irq_name before pinning those interrupts
to CPU 0. irq_name is a per-vector NAME_SIZE buffer, but not every
slot is populated before this loop runs. strstr() keeps scanning until
it finds a NUL terminator, so an uninitialized slot can trigger a KASAN
slab-out-of-bounds read at boot when debug options are enabled.

Use strnstr() with NAME_SIZE to bound the search within each vector's
name buffer.

Fixes: 4e527f1e5c15 ("octeontx2-af: npc: cn20k: Add new mailboxes for CN20K silicon")
Signed-off-by: Anshumali Gaur <agaur@marvell.com>
Signed-off-by: Ratheesh Kannoth <rkannoth@marvell.com>
---
 drivers/net/ethernet/marvell/octeontx2/af/rvu.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/net/ethernet/marvell/octeontx2/af/rvu.c b/drivers/net/ethernet/marvell/octeontx2/af/rvu.c
index ffba56ee8a60..43062390aa4c 100644
--- a/drivers/net/ethernet/marvell/octeontx2/af/rvu.c
+++ b/drivers/net/ethernet/marvell/octeontx2/af/rvu.c
@@ -3331,8 +3331,8 @@ static int rvu_register_interrupts(struct rvu *rvu)
 		goto fail;
 
 	for (i = 0; i < rvu->num_vec; i++) {
-		if (strstr(&rvu->irq_name[i * NAME_SIZE], "Mbox") ||
-		    strstr(&rvu->irq_name[i * NAME_SIZE], "FLR"))
+		if (strnstr(&rvu->irq_name[i * NAME_SIZE], "Mbox", NAME_SIZE) ||
+		    strnstr(&rvu->irq_name[i * NAME_SIZE], "FLR", NAME_SIZE))
 			irq_set_affinity(pci_irq_vector(rvu->pdev, i),
 					 cpumask_of(0));
 	}
-- 
2.43.0

Re: [PATCH net] octeontx2-af: fix out-of-bounds read setting MSI-X irq affinity

[Jakub Kicinski]

On Thu, 20 Aug 2026 11:24:51 +0530 Ratheesh Kannoth wrote:
> rvu_register_interrupts() walks every MSI-X vector and uses strstr()
> to match "Mbox" or "FLR" in irq_name before pinning those interrupts
> to CPU 0. irq_name is a per-vector NAME_SIZE buffer, but not every
> slot is populated before this loop runs. strstr() keeps scanning until
> it finds a NUL terminator, so an uninitialized slot can trigger a KASAN
> slab-out-of-bounds read at boot when debug options are enabled.
> 
> Use strnstr() with NAME_SIZE to bound the search within each vector's
> name buffer.

String search for this sort of type tracking in C is a.. brave choice :/
But whatever..

Re: [PATCH net] octeontx2-af: fix out-of-bounds read setting MSI-X irq affinity

[patchwork-bot+netdevbpf]

Hello:

This patch was applied to netdev/net.git (main)
by Jakub Kicinski <kuba@kernel.org>:

On Thu, 20 Aug 2026 11:24:51 +0530 you wrote:
> From: Anshumali Gaur <agaur@marvell.com>
> 
> rvu_register_interrupts() walks every MSI-X vector and uses strstr()
> to match "Mbox" or "FLR" in irq_name before pinning those interrupts
> to CPU 0. irq_name is a per-vector NAME_SIZE buffer, but not every
> slot is populated before this loop runs. strstr() keeps scanning until
> it finds a NUL terminator, so an uninitialized slot can trigger a KASAN
> slab-out-of-bounds read at boot when debug options are enabled.
> 
> [...]

Here is the summary with links:
  - [net] octeontx2-af: fix out-of-bounds read setting MSI-X irq affinity
    https://git.kernel.org/netdev/net/c/4d5df98369c5

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html