[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Date: Fri, 5 May 2023 12:32:20 +0300
From: Maksim Davydov <davydov-max@...dex-team.ru>
To: Leon Romanovsky <leon@...nel.org>
Cc: rajur@...lsio.com, davem@...emloft.net, edumazet@...gle.com,
kuba@...nel.org, pabeni@...hat.com, anish@...lsio.com,
hariprasad@...lsio.com, netdev@...r.kernel.org,
linux-kernel@...r.kernel.org
Subject: Re: [PATCH net 1/2] net/ethernet/chelsio: fix cxgb4_getpgtccfg wrong
memory access
Ping
To summarize:
*pgid can be 0xF, but valid values are 0-7. Whether *bw_per is set or
not set inside if-block, it will have valid value (it was set to zero
before)
On 1/18/23 11:29, Maksim Davydov wrote:
>
> On 1/17/23 12:21, Leon Romanovsky wrote:
>> On Mon, Jan 16, 2023 at 06:20:59PM +0300, Maksim Davydov wrote:
>>> *pgid can be in range 0 to 0xF (bitmask 0xF) but valid values for PGID
>>> are between 0 and 7. Also the size of pgrate is 8. Thus, we are needed
>>> additional check to make sure that this code doesn't have access to
>>> tsa.
>>>
>>> Found by Linux Verification Center (linuxtesting.org) with the SVACE
>>> static analysis tool.
>>>
>>> Fixes: 76bcb31efc06 ("cxgb4 : Add DCBx support codebase and dcbnl_ops")
>>> Signed-off-by: Maksim Davydov <davydov-max@...dex-team.ru>
>>> ---
>>> drivers/net/ethernet/chelsio/cxgb4/cxgb4_dcb.c | 5 ++++-
>>> 1 file changed, 4 insertions(+), 1 deletion(-)
>>>
>>> diff --git a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_dcb.c
>>> b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_dcb.c
>>> index 7d5204834ee2..3aa65f0f335e 100644
>>> --- a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_dcb.c
>>> +++ b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_dcb.c
>>> @@ -471,7 +471,10 @@ static void cxgb4_getpgtccfg(struct net_device
>>> *dev, int tc,
>>> return;
>>> }
>>> - *bw_per = pcmd.u.dcb.pgrate.pgrate[*pgid];
>>> + /* Valid values are: 0-7 */
>> How do you see it?
>>
>> There are lines below that assume something different.
>> 477 /* prio_type is link strict */
>> 478 if (*pgid != 0xF)
>> 479 *prio_type = 0x2;
>>
> But if *pgid == 0xF we get value for *bw_per from pgrate.tsa, it seems
> not correct
>
> Thanks for reviewing,
> Maksim Davydov
>>> + if (*pgid <= 7)
>>> + *bw_per = pcmd.u.dcb.pgrate.pgrate[*pgid];
>> Why do you think that it is valid simply do not set *bw_per?
>>
>> Thanks
--
Best regards,
Maksim Davydov
Powered by blists - more mailing lists