netdev - [PATCH net-next 5/5] bnx2x: Don't allow VFs to become promiscuous

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Sun, 23 Mar 2014 18:12:27 +0200
From:	Yuval Mintz <Yuval.Mintz@...gic.com>
To:	<netdev@...r.kernel.org>, <davem@...emloft.net>
CC:	<Ariel.Elior@...gic.com>, Yuval Mintz <Yuval.Mintz@...gic.com>
Subject: [PATCH net-next 5/5] bnx2x: Don't allow VFs to become promiscuous

Currently, if a VF's Rx Mode will be configured to support promiscuous mode
the PF will comply, causing the VF to actually become promiscuous.
This will enable the VF to see all unicast traffic which might be intended for
other VMs, which we believe should not be possible.

This patch will cause the hypervisor to ignore the VF's request for changes in
its Rx mode (other than disabling it), preventing it from becoming promiscuous.

Reported-by: Yoann Juet <yoann.juet@...v-nantes.fr>
Signed-off-by: Yuval Mintz <Yuval.Mintz@...gic.com>
Signed-off-by: Ariel Elior <Ariel.Elior@...gic.com>
---
 drivers/net/ethernet/broadcom/bnx2x/bnx2x_vfpf.c | 42 ++++++------------------
 1 file changed, 10 insertions(+), 32 deletions(-)

diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_vfpf.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_vfpf.c
index fe3737e..0622884 100644
--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_vfpf.c
+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_vfpf.c
@@ -896,29 +896,16 @@ int bnx2x_vfpf_storm_rx_mode(struct bnx2x *bp)
 
 	DP(NETIF_MSG_IFUP, "Rx mode is %d\n", mode);
 
-	switch (mode) {
-	case BNX2X_RX_MODE_NONE: /* no Rx */
+	/* Ignore everything accept MODE_NONE */
+	if (mode  == BNX2X_RX_MODE_NONE) {
 		req->rx_mask = VFPF_RX_MASK_ACCEPT_NONE;
-		break;
-	case BNX2X_RX_MODE_NORMAL:
+	} else {
+		/* Current PF driver will not look at the specific flags,
+		 * but they are required when working with older drivers on hv.
+		 */
 		req->rx_mask = VFPF_RX_MASK_ACCEPT_MATCHED_MULTICAST;
 		req->rx_mask |= VFPF_RX_MASK_ACCEPT_MATCHED_UNICAST;
 		req->rx_mask |= VFPF_RX_MASK_ACCEPT_BROADCAST;
-		break;
-	case BNX2X_RX_MODE_ALLMULTI:
-		req->rx_mask = VFPF_RX_MASK_ACCEPT_ALL_MULTICAST;
-		req->rx_mask |= VFPF_RX_MASK_ACCEPT_MATCHED_UNICAST;
-		req->rx_mask |= VFPF_RX_MASK_ACCEPT_BROADCAST;
-		break;
-	case BNX2X_RX_MODE_PROMISC:
-		req->rx_mask = VFPF_RX_MASK_ACCEPT_ALL_UNICAST;
-		req->rx_mask |= VFPF_RX_MASK_ACCEPT_ALL_MULTICAST;
-		req->rx_mask |= VFPF_RX_MASK_ACCEPT_BROADCAST;
-		break;
-	default:
-		BNX2X_ERR("BAD rx mode (%d)\n", mode);
-		rc = -EINVAL;
-		goto out;
 	}
 
 	req->flags |= VFPF_SET_Q_FILTERS_RX_MASK_CHANGED;
@@ -939,7 +926,7 @@ int bnx2x_vfpf_storm_rx_mode(struct bnx2x *bp)
 		BNX2X_ERR("Set Rx mode failed: %d\n", resp->hdr.status);
 		rc = -EINVAL;
 	}
-out:
+
 	bnx2x_vfpf_finalize(bp, &req->first_tlv);
 
 	return rc;
@@ -1571,21 +1558,12 @@ static int bnx2x_vf_mbx_qfilters(struct bnx2x *bp, struct bnx2x_virtf *vf)
 		struct pf_vf_bulletin_content *bulletin =
 					BP_VF_BULLETIN(bp, vf->index);
 
-		/* covert VF-PF if mask to bnx2x accept flags */
-		if (msg->rx_mask & VFPF_RX_MASK_ACCEPT_MATCHED_UNICAST)
+		/* Ignore VF requested mode; instead set a regular mode */
+		if (msg->rx_mask !=  VFPF_RX_MASK_ACCEPT_NONE) {
 			__set_bit(BNX2X_ACCEPT_UNICAST, &accept);
-
-		if (msg->rx_mask & VFPF_RX_MASK_ACCEPT_MATCHED_MULTICAST)
 			__set_bit(BNX2X_ACCEPT_MULTICAST, &accept);
-
-		if (msg->rx_mask & VFPF_RX_MASK_ACCEPT_ALL_UNICAST)
-			__set_bit(BNX2X_ACCEPT_ALL_UNICAST, &accept);
-
-		if (msg->rx_mask & VFPF_RX_MASK_ACCEPT_ALL_MULTICAST)
-			__set_bit(BNX2X_ACCEPT_ALL_MULTICAST, &accept);
-
-		if (msg->rx_mask & VFPF_RX_MASK_ACCEPT_BROADCAST)
 			__set_bit(BNX2X_ACCEPT_BROADCAST, &accept);
+		}
 
 		/* A packet arriving the vf's mac should be accepted
 		 * with any vlan, unless a vlan has already been
-- 
1.8.1.227.g44fe835

--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html