From patchwork Mon Sep 30 22:35:56 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Tony Nguyen X-Patchwork-Id: 13817197 X-Patchwork-Delegate: kuba@kernel.org Received: from mgamail.intel.com (mgamail.intel.com [192.198.163.12]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id F3AC51A0BCB; Mon, 30 Sep 2024 22:36:12 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=192.198.163.12 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1727735774; cv=none; b=L/5zkkrmRB0tF+cXULPByZQhHCkATSUATS33YOzcGsK4ThvzVHrjOiRoEeDadgaDNfXbG1jQhPaJH2HIR3O+y7OaZ9/OR+NDm9lUkU2XM+dEIK7UaCPj5F2oJQ/3PJwH1H2wXJ/NzeX+FfozFpF7NS34nzfZCvHqIOuMR4t9dlo= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1727735774; c=relaxed/simple; bh=EQagrq8iEetD3afIvCwI9WqOrnNYF4kt2DFH6ckk9WA=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=jzYXK++XggQeqIVSt68BCkLAc/AXeZHnpuuyyVrKCN7NN9wvOaLNiPrns7GLuH66wQf0ptuV0eil+3P1alWPcjkcSBv+TMHhvlaW4LL+fbw9o59n7synk9b5GqpGGencnHTMkfTOk9msmRQGqPGhfGQYjQeIktzCnJHnqfgn9A8= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=intel.com; spf=pass smtp.mailfrom=intel.com; dkim=pass (2048-bit key) header.d=intel.com header.i=@intel.com header.b=cJhmxLRp; arc=none smtp.client-ip=192.198.163.12 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=intel.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=intel.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=intel.com header.i=@intel.com header.b="cJhmxLRp" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=intel.com; i=@intel.com; q=dns/txt; s=Intel; t=1727735773; x=1759271773; h=from:to:cc:subject:date:message-id:in-reply-to: references:mime-version:content-transfer-encoding; bh=EQagrq8iEetD3afIvCwI9WqOrnNYF4kt2DFH6ckk9WA=; b=cJhmxLRpciIdse/OInFw+vCXiRe4siYmqy7UR/pcI8yKCNK4xng2uFLh Y8376W62VOdPtjsvBngQTXg6Dtw/ZET1S1penNNdlNlb1XBI0UFYkRsGI V0pKHj3Gzt7Y64TgA6/cf4p11IgJHVOAQ9PUnOeMTPmg6qLGmjszoS8vH WKEugBAOuYqGl3XXKWbCsRFJYUHaJVdrZqhU0nMBBuWMnQkLPrQcOxlDW W6C5xurV4+GTPRoeRDFqHz3jVD9HtpKLkVqFPOGs0ZTdJHOXGYGVGcns7 2lmVZl3hXunPtZ+IevlSgy3zfwk5nDd49uomTeveedMG7xBAmVvoUZwkr Q==; X-CSE-ConnectionGUID: UQmJfDO9RnSpW5vp7etqyQ== X-CSE-MsgGUID: Hu7f0tbQRRS907As69k8pQ== X-IronPort-AV: E=McAfee;i="6700,10204,11211"; a="30734900" X-IronPort-AV: E=Sophos;i="6.11,166,1725346800"; d="scan'208";a="30734900" Received: from orviesa009.jf.intel.com ([10.64.159.149]) by fmvoesa106.fm.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 30 Sep 2024 15:36:07 -0700 X-CSE-ConnectionGUID: vu0kw/eISsCfeXJP1yFqYg== X-CSE-MsgGUID: Nh9hUM+VRdCSWL+BqRaMFQ== X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="6.11,166,1725346800"; d="scan'208";a="73496635" Received: from anguy11-upstream.jf.intel.com ([10.166.9.133]) by orviesa009.jf.intel.com with ESMTP; 30 Sep 2024 15:36:07 -0700 From: Tony Nguyen To: davem@davemloft.net, kuba@kernel.org, pabeni@redhat.com, edumazet@google.com, netdev@vger.kernel.org Cc: Joshua Hay , anthony.l.nguyen@intel.com, aleksander.lobakin@intel.com, milena.olech@intel.com, stable@vger.kernel.org, Przemek Kitszel , Krishneil Singh Subject: [PATCH net 09/10] idpf: use actual mbx receive payload length Date: Mon, 30 Sep 2024 15:35:56 -0700 Message-ID: <20240930223601.3137464-10-anthony.l.nguyen@intel.com> X-Mailer: git-send-email 2.46.0.522.gc50d79eeffbf In-Reply-To: <20240930223601.3137464-1-anthony.l.nguyen@intel.com> References: <20240930223601.3137464-1-anthony.l.nguyen@intel.com> Precedence: bulk X-Mailing-List: netdev@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-Patchwork-Delegate: kuba@kernel.org From: Joshua Hay When a mailbox message is received, the driver is checking for a non 0 datalen in the controlq descriptor. If it is valid, the payload is attached to the ctlq message to give to the upper layer. However, the payload response size given to the upper layer was taken from the buffer metadata which is _always_ the max buffer size. This meant the API was returning 4K as the payload size for all messages. This went unnoticed since the virtchnl exchange response logic was checking for a response size less than 0 (error), not less than exact size, or not greater than or equal to the max mailbox buffer size (4K). All of these checks will pass in the success case since the size provided is always 4K. However, this breaks anyone that wants to validate the exact response size. Fetch the actual payload length from the value provided in the descriptor data_len field (instead of the buffer metadata). Unfortunately, this means we lose some extra error parsing for variable sized virtchnl responses such as create vport and get ptypes. However, the original checks weren't really helping anyways since the size was _always_ 4K. Fixes: 34c21fa894a1 ("idpf: implement virtchnl transaction manager") Cc: stable@vger.kernel.org # 6.9+ Signed-off-by: Joshua Hay Reviewed-by: Przemek Kitszel Tested-by: Krishneil Singh Signed-off-by: Tony Nguyen --- drivers/net/ethernet/intel/idpf/idpf_virtchnl.c | 9 +-------- 1 file changed, 1 insertion(+), 8 deletions(-) diff --git a/drivers/net/ethernet/intel/idpf/idpf_virtchnl.c b/drivers/net/ethernet/intel/idpf/idpf_virtchnl.c index 70986e12da28..3c0f97650d72 100644 --- a/drivers/net/ethernet/intel/idpf/idpf_virtchnl.c +++ b/drivers/net/ethernet/intel/idpf/idpf_virtchnl.c @@ -666,7 +666,7 @@ idpf_vc_xn_forward_reply(struct idpf_adapter *adapter, if (ctlq_msg->data_len) { payload = ctlq_msg->ctx.indirect.payload->va; - payload_size = ctlq_msg->ctx.indirect.payload->size; + payload_size = ctlq_msg->data_len; } xn->reply_sz = payload_size; @@ -1295,10 +1295,6 @@ int idpf_send_create_vport_msg(struct idpf_adapter *adapter, err = reply_sz; goto free_vport_params; } - if (reply_sz < IDPF_CTLQ_MAX_BUF_LEN) { - err = -EIO; - goto free_vport_params; - } return 0; @@ -2602,9 +2598,6 @@ int idpf_send_get_rx_ptype_msg(struct idpf_vport *vport) if (reply_sz < 0) return reply_sz; - if (reply_sz < IDPF_CTLQ_MAX_BUF_LEN) - return -EIO; - ptypes_recvd += le16_to_cpu(ptype_info->num_ptypes); if (ptypes_recvd > max_ptype) return -EINVAL;