netdev - [PATCH iwl-net v1] i40e:Fix filter input checks to prevent config with invalid values

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-Id: <20231129100933.2753577-1-aleksandr.loktionov@intel.com>
Date: Wed, 29 Nov 2023 11:09:33 +0100
From: Aleksandr Loktionov <aleksandr.loktionov@...el.com>
To: intel-wired-lan@...ts.osuosl.org,
	anthony.l.nguyen@...el.com,
	aleksandr.loktionov@...el.com
Cc: netdev@...r.kernel.org,
	Sudheer Mogilappagari <sudheer.mogilappagari@...el.com>,
	Andrii Staikov <andrii.staikov@...el.com>
Subject: [PATCH iwl-net v1] i40e:Fix filter input checks to prevent config with invalid values

From: Sudheer Mogilappagari <sudheer.mogilappagari@...el.com>

Prevent VF from configuring filters with unsupported actions or use
REDIRECT action with invalid tc number. Current checks could cause
out of bounds access on PF side.

Reviewed-by: Andrii Staikov <andrii.staikov@...el.com>
Signed-off-by: Sudheer Mogilappagari <sudheer.mogilappagari@...el.com>
Signed-off-by: Aleksandr Loktionov <aleksandr.loktionov@...el.com>
---
 drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c b/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c
index 3f99eb1..031b15c 100644
--- a/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c
+++ b/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c
@@ -3521,16 +3521,16 @@ static int i40e_validate_cloud_filter(struct i40e_vf *vf,
 	bool found = false;
 	int bkt;
 
-	if (!tc_filter->action) {
+	if (tc_filter->action != VIRTCHNL_ACTION_TC_REDIRECT) {
 		dev_info(&pf->pdev->dev,
-			 "VF %d: Currently ADq doesn't support Drop Action\n",
-			 vf->vf_id);
+			 "VF %d: ADQ doesn't support this action (%d)\n",
+			 vf->vf_id, tc_filter->action);
 		goto err;
 	}
 
 	/* action_meta is TC number here to which the filter is applied */
 	if (!tc_filter->action_meta ||
-	    tc_filter->action_meta > I40E_MAX_VF_VSI) {
+	    tc_filter->action_meta > vf->num_tc) {
 		dev_info(&pf->pdev->dev, "VF %d: Invalid TC number %u\n",
 			 vf->vf_id, tc_filter->action_meta);
 		goto err;
-- 
2.25.1