| Message ID | 20221121213708.13645-1-edward.cree@amd.com (mailing list archive) |
|---|---|
| State | Accepted |
| Commit | e80bd08fd75a644e2337fb535c1afdb6417357ff |
| Delegated to: | Netdev Maintainers |
| Headers | show |
| Series | [net-next] sfc: ensure type is valid before updating seen_gen | expand |
On Mon, Nov 21, 2022 at 09:37:08PM +0000, edward.cree@amd.com wrote: > From: Edward Cree <ecree.xilinx@gmail.com> > > In the case of invalid or corrupted v2 counter update packets, > efx_tc_rx_version_2() returns EFX_TC_COUNTER_TYPE_MAX. In this case > we should not attempt to update generation counts as this will write > beyond the end of the seen_gen array. > > Reported-by: coverity-bot <keescook+coverity-bot@chromium.org> > Addresses-Coverity-ID: 1527356 ("Memory - illegal accesses") > Fixes: 25730d8be5d8 ("sfc: add extra RX channel to receive MAE counter updates on ef100") > Signed-off-by: Edward Cree <ecree.xilinx@gmail.com> Reviewed-by: Kees Cook <keescook@chromium.org>
Hello: This patch was applied to netdev/net-next.git (master) by David S. Miller <davem@davemloft.net>: On Mon, 21 Nov 2022 21:37:08 +0000 you wrote: > From: Edward Cree <ecree.xilinx@gmail.com> > > In the case of invalid or corrupted v2 counter update packets, > efx_tc_rx_version_2() returns EFX_TC_COUNTER_TYPE_MAX. In this case > we should not attempt to update generation counts as this will write > beyond the end of the seen_gen array. > > [...] Here is the summary with links: - [net-next] sfc: ensure type is valid before updating seen_gen https://git.kernel.org/netdev/net-next/c/e80bd08fd75a You are awesome, thank you!
diff --git a/drivers/net/ethernet/sfc/tc_counters.c b/drivers/net/ethernet/sfc/tc_counters.c index 2bba5d3a2fdb..d1a91d54c6bb 100644 --- a/drivers/net/ethernet/sfc/tc_counters.c +++ b/drivers/net/ethernet/sfc/tc_counters.c @@ -476,13 +476,15 @@ static bool efx_tc_rx(struct efx_rx_queue *rx_queue, u32 mark) goto out; } - /* Update seen_gen unconditionally, to avoid a missed wakeup if - * we race with efx_mae_stop_counters(). - */ - efx->tc->seen_gen[type] = mark; - if (efx->tc->flush_counters && - (s32)(efx->tc->flush_gen[type] - mark) <= 0) - wake_up(&efx->tc->flush_wq); + if (type < EFX_TC_COUNTER_TYPE_MAX) { + /* Update seen_gen unconditionally, to avoid a missed wakeup if + * we race with efx_mae_stop_counters(). + */ + efx->tc->seen_gen[type] = mark; + if (efx->tc->flush_counters && + (s32)(efx->tc->flush_gen[type] - mark) <= 0) + wake_up(&efx->tc->flush_wq); + } out: efx_free_rx_buffers(rx_queue, rx_buf, 1); channel->rx_pkt_n_frags = 0;