14.09.2023 10:06, Dmitry Frolov wrote:
According to cxl_interleave_ways_enc(), fw->num_targets is allowed to be up to 16. This also corresponds to CXL specs. So, the fw->target_hbs[] array is iterated from 0 to 15. But it is statically declared of length 8. Thus, out of bound array access may occur.Found by Linux Verification Center (linuxtesting.org) with SVACE. v2: assert added v3: assert removed
So it's the same as the initial submission. /mjt
