[PATCH] ice: clamp package info count to the response buffer

[PATCH] ice: clamp package info count to the response buffer

[Noah Weinberger]

Hello,

ice_get_pkg_info() and the DDP-load compatibility check iterate
over the count field of the admin-queue GET_PKG_INFO response, but
the response buffer is a flexible array sized ICE_PKG_CNT (4):

    DEFINE_RAW_FLEX(struct ice_aqc_get_pkg_info_resp, pkg_info, pkg_info,
                    ICE_PKG_CNT);
    ...
    for (i = 0; i < le32_to_cpu(pkg_info->count); i++) {

A device (or compromised firmware) that reports more than four
entries makes both loops read past the stack buffer, and the
'active package' name/version handling then copies out-of-bounds
stack data into hw->active_pkg_name. The patch clamps both loops to
the buffer size.

Affected version/commit: mainline 8a65162514fbad21a2c58ffed65f42b27e92b163 (v7.4-rc2 window, 2026-11-08), drivers/net/ethernet/intel/ice/ice_ddp.c:1993-2015 (ice_get_pkg_info: DEFINE_RAW_FLEX(..., ICE_PKG_CNT = 4) then for (i = 0; i < le32_to_cpu(pkg_info->count); i++)), :2067-2077 (same pattern with pkg->count)
Longstanding; converted to DEFINE_RAW_FLEX at some point without adding the clamp.

This was found during an assisted (AI-supported) static source review of
mainline 8a65162514fbad21a2c58ffed65f42b27e92b163 (v7.4-rc2 window, 2026-11-08). The patch below has NOT been compiled and has
NOT been runtime tested, and no reproducer was produced - the triggering
conditions are described above instead. Please treat this as a report for
verification rather than a battle-tested fix.

---
diff --git a/drivers/net/ethernet/intel/ice/ice_ddp.c b/drivers/net/ethernet/intel/ice/ice_ddp.c
index 3b2d9c4369..bb037ee96b 100644
--- a/drivers/net/ethernet/intel/ice/ice_ddp.c
+++ b/drivers/net/ethernet/intel/ice/ice_ddp.c
@@ -1998,7 +1998,7 @@ static enum ice_ddp_state ice_get_pkg_info(struct ice_hw *hw)
 	if (ice_aq_get_pkg_info_list(hw, pkg_info, size, NULL))
 		return ICE_DDP_PKG_ERR;
 
-	for (i = 0; i < le32_to_cpu(pkg_info->count); i++) {
+	for (i = 0; i < le32_to_cpu(pkg_info->count) && i < ICE_PKG_CNT; i++) {
 #define ICE_PKG_FLAG_COUNT 4
 		char flags[ICE_PKG_FLAG_COUNT + 1] = { 0 };
 		u8 place = 0;
@@ -2067,7 +2067,7 @@ static enum ice_ddp_state ice_chk_pkg_compat(struct ice_hw *hw,
 	if (ice_aq_get_pkg_info_list(hw, pkg, size, NULL))
 		return ICE_DDP_PKG_LOAD_ERROR;
 
-	for (i = 0; i < le32_to_cpu(pkg->count); i++) {
+	for (i = 0; i < le32_to_cpu(pkg->count) && i < ICE_PKG_CNT; i++) {
 		/* loop till we find the NVM package */
 		if (!pkg->pkg_info[i].is_in_nvm)
 			continue;

Re: [PATCH] ice: clamp package info count to the response buffer

[Przemek Kitszel]

On 11/9/26 12:55 AM, Noah Weinberger wrote:
> Hello,
> 
> ice_get_pkg_info() and the DDP-load compatibility check iterate
> over the count field of the admin-queue GET_PKG_INFO response, but
> the response buffer is a flexible array sized ICE_PKG_CNT (4):
> 
>      DEFINE_RAW_FLEX(struct ice_aqc_get_pkg_info_resp, pkg_info, pkg_info,
>                      ICE_PKG_CNT);
>      ...
>      for (i = 0; i < le32_to_cpu(pkg_info->count); i++) {
> 
> A device (or compromised firmware) that reports more than four
> entries makes both loops read past the stack buffer, and the
> 'active package' name/version handling then copies out-of-bounds
> stack data into hw->active_pkg_name. The patch clamps both loops to
> the buffer size.
> 
> Affected version/commit: mainline 8a65162514fbad21a2c58ffed65f42b27e92b163 (v7.4-rc2 window, 2026-11-08), drivers/net/ethernet/intel/ice/ice_ddp.c:1993-2015 (ice_get_pkg_info: DEFINE_RAW_FLEX(..., ICE_PKG_CNT = 4) then for (i = 0; i < le32_to_cpu(pkg_info->count); i++)), :2067-2077 (same pattern with pkg->count)
> Longstanding; converted to DEFINE_RAW_FLEX at some point without adding the clamp.
> 
> This was found during an assisted (AI-supported) static source review of
> mainline 8a65162514fbad21a2c58ffed65f42b27e92b163 (v7.4-rc2 window, 2026-11-08). The patch below has NOT been compiled and has
> NOT been runtime tested, and no reproducer was produced - the triggering
> conditions are described above instead. Please treat this as a report for
> verification rather than a battle-tested fix.
> 
> ---
> diff --git a/drivers/net/ethernet/intel/ice/ice_ddp.c b/drivers/net/ethernet/intel/ice/ice_ddp.c
> index 3b2d9c4369..bb037ee96b 100644
> --- a/drivers/net/ethernet/intel/ice/ice_ddp.c
> +++ b/drivers/net/ethernet/intel/ice/ice_ddp.c
> @@ -1998,7 +1998,7 @@ static enum ice_ddp_state ice_get_pkg_info(struct ice_hw *hw)
>   	if (ice_aq_get_pkg_info_list(hw, pkg_info, size, NULL))
>   		return ICE_DDP_PKG_ERR;
>   
> -	for (i = 0; i < le32_to_cpu(pkg_info->count); i++) {
> +	for (i = 0; i < le32_to_cpu(pkg_info->count) && i < ICE_PKG_CNT; i++) {

you basically report a "malicious FW" here
personally I would ignore

(same for the other of your patches)

>   #define ICE_PKG_FLAG_COUNT 4
>   		char flags[ICE_PKG_FLAG_COUNT + 1] = { 0 };
>   		u8 place = 0;
> @@ -2067,7 +2067,7 @@ static enum ice_ddp_state ice_chk_pkg_compat(struct ice_hw *hw,
>   	if (ice_aq_get_pkg_info_list(hw, pkg, size, NULL))
>   		return ICE_DDP_PKG_LOAD_ERROR;
>   
> -	for (i = 0; i < le32_to_cpu(pkg->count); i++) {
> +	for (i = 0; i < le32_to_cpu(pkg->count) && i < ICE_PKG_CNT; i++) {
>   		/* loop till we find the NVM package */
>   		if (!pkg->pkg_info[i].is_in_nvm)
>   			continue;
>