[PATCH net] net: mvpp2: prevent buffer overflow in page_pool allocation

[PATCH net] net: mvpp2: prevent buffer overflow in page_pool allocation

[Dmitriy Okunev]

The per‑processor buffering scheme is supported only if the
number of pools (nrxqs * 2) does not exceed MVPP2_BM_MAX_POOLS (8).
This is already checked in mvpp2_probe() during the initial
activation of percpu_pools.

However, mvpp2_change_mtu() may later call
mvpp2_bm_switch_buffers(priv, true) without this check, which can
lead to an out-of-bounds access in the priv->page_pool array in
mvpp2_bm_init(). The array is sized to hold MVPP2_PORT_MAX_RXQ
entries, and mvpp2_get_nrxqs() may return exactly that value. The
per-CPU scheme then doubles it to nrxqs * 2, exceeding the array
bounds.

Check that the hardware version is MVPP22 or newer and that the
number of pools (nrxqs * 2) does not exceed MVPP2_BM_MAX_POOLS
before switching to per-CPU mode.

Found by Linux Verification Center (linuxtesting.org) with SVACE.

Fixes: 7d04b0b13b11 ("mvpp2: percpu buffers")
Signed-off-by: Dmitriy Okunev <dokunevdmitriy@gmail.com>
---

 drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c b/drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c
index ccc24a1301f2..848ee655c6ea 100644
--- a/drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c
+++ b/drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c
@@ -5086,7 +5086,8 @@ static int mvpp2_change_mtu(struct net_device *dev, int mtu)
 			netdev_warn(dev, "mtu %d too high, switching to shared buffers", mtu);
 			mvpp2_bm_switch_buffers(priv, false);
 		}
-	} else {
+	} else if (priv->hw_version >= MVPP22 &&
+		   mvpp2_get_nrxqs(priv) * 2 <= MVPP2_BM_MAX_POOLS) {
 		bool jumbo = false;
 		int i;
 
-- 
2.53.0

Re: [PATCH net] net: mvpp2: prevent buffer overflow in page_pool allocation

[patchwork-bot+netdevbpf]

Hello:

This patch was applied to netdev/net.git (main)
by Paolo Abeni <pabeni@redhat.com>:

On Mon, 14 Sep 2026 12:15:57 +0300 you wrote:
> The per‑processor buffering scheme is supported only if the
> number of pools (nrxqs * 2) does not exceed MVPP2_BM_MAX_POOLS (8).
> This is already checked in mvpp2_probe() during the initial
> activation of percpu_pools.
> 
> However, mvpp2_change_mtu() may later call
> mvpp2_bm_switch_buffers(priv, true) without this check, which can
> lead to an out-of-bounds access in the priv->page_pool array in
> mvpp2_bm_init(). The array is sized to hold MVPP2_PORT_MAX_RXQ
> entries, and mvpp2_get_nrxqs() may return exactly that value. The
> per-CPU scheme then doubles it to nrxqs * 2, exceeding the array
> bounds.
> 
> [...]

Here is the summary with links:
  - [net] net: mvpp2: prevent buffer overflow in page_pool allocation
    https://git.kernel.org/netdev/net/c/14cb1e7702e5

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html