netdev - [PATCH net-next 12/12] mlxsw: Validate local port from CQE in PCI code

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <0bd312ed629e85a044725080b9f33403bb51ae41.1738665783.git.petrm@nvidia.com>
Date: Tue, 4 Feb 2025 12:05:07 +0100
From: Petr Machata <petrm@...dia.com>
To: "David S. Miller" <davem@...emloft.net>, Eric Dumazet
	<edumazet@...gle.com>, Jakub Kicinski <kuba@...nel.org>, Paolo Abeni
	<pabeni@...hat.com>, Andrew Lunn <andrew+netdev@...n.ch>,
	<netdev@...r.kernel.org>
CC: Amit Cohen <amcohen@...dia.com>, Ido Schimmel <idosch@...dia.com>, "Petr
 Machata" <petrm@...dia.com>, Alexei Starovoitov <ast@...nel.org>, "Daniel
 Borkmann" <daniel@...earbox.net>, Jesper Dangaard Brouer <hawk@...nel.org>,
	John Fastabend <john.fastabend@...il.com>, <bpf@...r.kernel.org>,
	<mlxsw@...dia.com>
Subject: [PATCH net-next 12/12] mlxsw: Validate local port from CQE in PCI code

From: Amit Cohen <amcohen@...dia.com>

Currently, there is a check in core code to validate that the received
local port does not exceed number of ports in the switch. Next patch will
have to validate it also in PCI, before accessing the pci_ports array.
There is no reason to check it twice, so move this check to PCI code.

Note that 'mlxsw_pci->max_ports' and 'mlxsw_core->max_ports' store the same
value, which is read from firmware.

Signed-off-by: Amit Cohen <amcohen@...dia.com>
Reviewed-by: Ido Schimmel <idosch@...dia.com>
Signed-off-by: Petr Machata <petrm@...dia.com>
---
 drivers/net/ethernet/mellanox/mlxsw/core.c | 3 +--
 drivers/net/ethernet/mellanox/mlxsw/pci.c  | 3 +++
 2 files changed, 4 insertions(+), 2 deletions(-)

diff --git a/drivers/net/ethernet/mellanox/mlxsw/core.c b/drivers/net/ethernet/mellanox/mlxsw/core.c
index 628530e01b19..962283bbfe18 100644
--- a/drivers/net/ethernet/mellanox/mlxsw/core.c
+++ b/drivers/net/ethernet/mellanox/mlxsw/core.c
@@ -2959,8 +2959,7 @@ void mlxsw_core_skb_receive(struct mlxsw_core *mlxsw_core, struct sk_buff *skb,
 	const struct mlxsw_rx_listener *rxl;
 	bool found = false;
 
-	if ((rx_info->trap_id >= MLXSW_TRAP_ID_MAX) ||
-	    (rx_info->local_port >= mlxsw_core->max_ports))
+	if (rx_info->trap_id >= MLXSW_TRAP_ID_MAX)
 		goto drop;
 
 	rcu_read_lock();
diff --git a/drivers/net/ethernet/mellanox/mlxsw/pci.c b/drivers/net/ethernet/mellanox/mlxsw/pci.c
index b560c21fd3ef..778493b21318 100644
--- a/drivers/net/ethernet/mellanox/mlxsw/pci.c
+++ b/drivers/net/ethernet/mellanox/mlxsw/pci.c
@@ -845,6 +845,9 @@ static void mlxsw_pci_cqe_rdq_handle(struct mlxsw_pci *mlxsw_pci,
 		rx_info.local_port = mlxsw_pci_cqe_system_port_get(cqe);
 	}
 
+	if (rx_info.local_port >= mlxsw_pci->max_ports)
+		goto out;
+
 	err = mlxsw_pci_rx_pkt_info_init(q->pci, elem_info, byte_count,
 					 &rx_pkt_info);
 	if (err)
-- 
2.47.0