linux-kernel - RE: [PATCH net 8/8] net: hns3: add checking for vf id of mailbox

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Thu, 7 Mar 2024 11:09:39 +0000
From: Sunil Kovvuri Goutham <sgoutham@...vell.com>
To: Jijie Shao <shaojijie@...wei.com>,
        "yisen.zhuang@...wei.com"
	<yisen.zhuang@...wei.com>,
        "salil.mehta@...wei.com" <salil.mehta@...wei.com>,
        "davem@...emloft.net" <davem@...emloft.net>,
        "edumazet@...gle.com"
	<edumazet@...gle.com>,
        "kuba@...nel.org" <kuba@...nel.org>,
        "pabeni@...hat.com" <pabeni@...hat.com>
CC: "shenjian15@...wei.com" <shenjian15@...wei.com>,
        "wangjie125@...wei.com"
	<wangjie125@...wei.com>,
        "liuyonglong@...wei.com" <liuyonglong@...wei.com>,
        "netdev@...r.kernel.org" <netdev@...r.kernel.org>,
        "linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>
Subject: RE: [PATCH net 8/8] net: hns3: add checking for vf id of mailbox



> -----Original Message-----
> From: Jijie Shao <shaojijie@...wei.com>
> Sent: Thursday, March 7, 2024 6:31 AM
> To: yisen.zhuang@...wei.com; salil.mehta@...wei.com;
> davem@...emloft.net; edumazet@...gle.com; kuba@...nel.org;
> pabeni@...hat.com
> Cc: shenjian15@...wei.com; wangjie125@...wei.com;
> liuyonglong@...wei.com; shaojijie@...wei.com; netdev@...r.kernel.org;
> linux-kernel@...r.kernel.org
> Subject: [EXTERNAL] [PATCH net 8/8] net: hns3: add checking for vf id of
> mailbox
> 
> From: Jian Shen <shenjian15@...wei.com>
> 
> Add checking for vf id of mailbox, in order to avoid array out-of-bounds risk.
> 
> Signed-off-by: Jian Shen <shenjian15@...wei.com>
> Signed-off-by: Jijie Shao <shaojijie@...wei.com>
> ---
>  drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_mbx.c | 7 ++++---
>  1 file changed, 4 insertions(+), 3 deletions(-)
> 
> diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_mbx.c
> b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_mbx.c
> index 4b0d07ca2505..d4a0e0be7a72 100644
> --- a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_mbx.c
> +++ b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_mbx.c
> @@ -1123,10 +1123,11 @@ void hclge_mbx_handler(struct hclge_dev
> *hdev)
>  		req = (struct hclge_mbx_vf_to_pf_cmd *)desc->data;
> 
>  		flag = le16_to_cpu(crq->desc[crq->next_to_use].flag);
> -		if (unlikely(!hnae3_get_bit(flag,
> HCLGE_CMDQ_RX_OUTVLD_B))) {
> +		if (unlikely(!hnae3_get_bit(flag,
> HCLGE_CMDQ_RX_OUTVLD_B) ||
> +			     req->mbx_src_vfid > hdev->num_req_vfs)) {
>  			dev_warn(&hdev->pdev->dev,
> -				 "dropped invalid mailbox message, code =
> %u\n",
> -				 req->msg.code);
> +				 "dropped invalid mailbox message, code =
> %u, vfid = %u\n",
> +				 req->msg.code, req->mbx_src_vfid);
> 
>  			/* dropping/not processing this invalid message */
>  			crq->desc[crq->next_to_use].flag = 0;
> --
> 2.30.0
> 

Reviewed-by: Sunil Goutham <sgoutham@...vell.com>