RE: [PATCH net v3 3/3] net: fealnx: bound card_idx to prevent out-of-bounds access

[Loktionov, Aleksandr]

> -----Original Message-----
> From: Жамбакиев Радий Рикардинович <r.zhambakiev@xxxxxxxxxxxxxxxxx>
> Sent: Monday, October 19, 2026 3:43 PM
> To: Andrew Lunn <andrew+netdev@xxxxxxx>
> Cc: Жамбакиев Радий Рикардинович <r.zhambakiev@xxxxxxxxxxxxxxxxx>; David
> S. Miller <davem@xxxxxxxxxxxxx>; Eric Dumazet <edumazet@xxxxxxxxxx>;
> Jakub Kicinski <kuba@xxxxxxxxxx>; Paolo Abeni <pabeni@xxxxxxxxxx>;
> Michael Grzeschik <mgr@xxxxxxxxxx>; Jijie Shao <shaojijie@xxxxxxxxxx>;
> Loktionov, Aleksandr <aleksandr.loktionov@xxxxxxxxx>; Denis Benato
> <benato.denis96@xxxxxxxxx>; Uwe Kleine-König (The Capable Hub)
> <u.kleine-koenig@xxxxxxxxxxxx>; netdev@xxxxxxxxxxxxxxx; linux-
> kernel@xxxxxxxxxxxxxxx; lvc-project@xxxxxxxxxxxxxxxx;
> stable@xxxxxxxxxxxxxxx
> Subject: [PATCH net v3 3/3] net: fealnx: bound card_idx to prevent out-
> of-bounds access
> 
> From: Radiy Zhambakiev <r.zhambakiev@xxxxxxxxxxxxxxxxx>
> 
> card_idx is a static counter that is incremented on every probe. It can
> overflow and wrap to a negative value, which then indexes options[] and
> full_duplex[] out of bounds.
> Large values also no longer fit in the 12-byte boardname[] buffer.
> 
> Bound card_idx to 99999, the largest value that still fits into
> boardname, and fail the probe for any card beyond that.
> 
> fealnx is an old driver that cannot be tested properly on real hardware,
> so a minimal best-effort guard was chosen over a larger rework.
> 
> Found by Linux Verification Center (linuxtesting.org)
> 
> Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
> Cc: stable@xxxxxxxxxxxxxxx
> Signed-off-by: Radiy Zhambakiev <r.zhambakiev@xxxxxxxxxxxxxxxxx>
> ---
>  drivers/net/ethernet/fealnx.c | 5 +++++
>  1 file changed, 5 insertions(+)
> 
> diff --git a/drivers/net/ethernet/fealnx.c
> b/drivers/net/ethernet/fealnx.c index b5e96c7037f3..d5931c0314fc 100644
> --- a/drivers/net/ethernet/fealnx.c
> +++ b/drivers/net/ethernet/fealnx.c
> @@ -41,6 +41,7 @@ static int rx_copybreak;
>  /* interoperability.                                            */
>  /* The media type is usually passed in 'options[]'.             */
>  #define MAX_UNITS 8		/* More are supported, limit only on options
> */
> +#define MAX_CARD_IDX		99999
>  static int options[MAX_UNITS] = { -1, -1, -1, -1, -1, -1, -1, -1 };
> static int full_duplex[MAX_UNITS] = { -1, -1, -1, -1, -1, -1, -1, -1 };
> 
> @@ -489,6 +490,10 @@ static int fealnx_init_one(struct pci_dev *pdev,
>  	int bar = 1;
>  #endif
> 
> +	if (card_idx >= MAX_CARD_IDX) {
> +		dev_err(&pdev->dev, "card_idx is too big %d, aborting",
> card_idx);
> +		return -ENODEV;
> +	}
>  	card_idx++;
card_idx can reach 100000 is it ok? 

>  	sprintf(boardname, "fealnx%d", card_idx);
> 
> --
> 2.53.0