| Message ID | YJup3/Ih2vIOXK2R@mwanda (mailing list archive) |
|---|---|
| State | Accepted |
| Commit | e5cc361e21648b75f935f9571d4003aaee480214 |
| Delegated to: | Netdev Maintainers |
| Headers | show |
| Series | [net] octeontx2-pf: fix a buffer overflow in otx2_set_rxfh_context() | expand |
| Context | Check | Description |
|---|---|---|
| netdev/cover_letter | success | Link |
| netdev/fixes_present | success | Link |
| netdev/patch_count | success | Link |
| netdev/tree_selection | success | Clearly marked for net |
| netdev/subject_prefix | success | Link |
| netdev/cc_maintainers | success | CCed 7 of 7 maintainers |
| netdev/source_inline | success | Was 0 now: 0 |
| netdev/verify_signedoff | success | Link |
| netdev/module_param | success | Was 0 now: 0 |
| netdev/build_32bit | success | Errors and warnings before: 0 this patch: 0 |
| netdev/kdoc | success | Errors and warnings before: 0 this patch: 0 |
| netdev/verify_fixes | success | Link |
| netdev/checkpatch | success | total: 0 errors, 0 warnings, 0 checks, 10 lines checked |
| netdev/build_allmodconfig_warn | success | Errors and warnings before: 0 this patch: 0 |
| netdev/header_inline | success | Link |
On Wed, May 12, 2021 at 3:42 PM Dan Carpenter <dan.carpenter@oracle.com> wrote: > > This function is called from ethtool_set_rxfh() and "*rss_context" > comes from the user. Add some bounds checking to prevent memory > corruption. > > Fixes: 81a4362016e7 ("octeontx2-pf: Add RSS multi group support") > Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> > --- > drivers/net/ethernet/marvell/octeontx2/nic/otx2_ethtool.c | 4 ++++ > 1 file changed, 4 insertions(+) > > diff --git a/drivers/net/ethernet/marvell/octeontx2/nic/otx2_ethtool.c b/drivers/net/ethernet/marvell/octeontx2/nic/otx2_ethtool.c > index f4962a97a075..9d9a2e438acf 100644 > --- a/drivers/net/ethernet/marvell/octeontx2/nic/otx2_ethtool.c > +++ b/drivers/net/ethernet/marvell/octeontx2/nic/otx2_ethtool.c > @@ -786,6 +786,10 @@ static int otx2_set_rxfh_context(struct net_device *dev, const u32 *indir, > if (hfunc != ETH_RSS_HASH_NO_CHANGE && hfunc != ETH_RSS_HASH_TOP) > return -EOPNOTSUPP; > > + if (*rss_context != ETH_RXFH_CONTEXT_ALLOC && > + *rss_context >= MAX_RSS_GROUPS) > + return -EINVAL; > + > rss = &pfvf->hw.rss_info; > > if (!rss->enable) { > -- > 2.30.2 > Acked-by: Sunil Goutham <sgoutham@marvell.com>
Hello: This patch was applied to netdev/net.git (refs/heads/master): On Wed, 12 May 2021 13:11:43 +0300 you wrote: > This function is called from ethtool_set_rxfh() and "*rss_context" > comes from the user. Add some bounds checking to prevent memory > corruption. > > Fixes: 81a4362016e7 ("octeontx2-pf: Add RSS multi group support") > Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> > > [...] Here is the summary with links: - [net] octeontx2-pf: fix a buffer overflow in otx2_set_rxfh_context() https://git.kernel.org/netdev/net/c/e5cc361e2164 You are awesome, thank you! -- Deet-doot-dot, I am a bot. https://korg.docs.kernel.org/patchwork/pwbot.html
diff --git a/drivers/net/ethernet/marvell/octeontx2/nic/otx2_ethtool.c b/drivers/net/ethernet/marvell/octeontx2/nic/otx2_ethtool.c index f4962a97a075..9d9a2e438acf 100644 --- a/drivers/net/ethernet/marvell/octeontx2/nic/otx2_ethtool.c +++ b/drivers/net/ethernet/marvell/octeontx2/nic/otx2_ethtool.c @@ -786,6 +786,10 @@ static int otx2_set_rxfh_context(struct net_device *dev, const u32 *indir, if (hfunc != ETH_RSS_HASH_NO_CHANGE && hfunc != ETH_RSS_HASH_TOP) return -EOPNOTSUPP; + if (*rss_context != ETH_RXFH_CONTEXT_ALLOC && + *rss_context >= MAX_RSS_GROUPS) + return -EINVAL; + rss = &pfvf->hw.rss_info; if (!rss->enable) {
This function is called from ethtool_set_rxfh() and "*rss_context" comes from the user. Add some bounds checking to prevent memory corruption. Fixes: 81a4362016e7 ("octeontx2-pf: Add RSS multi group support") Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> --- drivers/net/ethernet/marvell/octeontx2/nic/otx2_ethtool.c | 4 ++++ 1 file changed, 4 insertions(+)