netdev - RE: [Intel-wired-lan] [PATCH net] i40e: fix incorrect src_ip checks and memcpy sizes in cloud filter

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <IA3PR11MB898684016DECAB9D679766CFE5C3A@IA3PR11MB8986.namprd11.prod.outlook.com>
Date: Fri, 7 Nov 2025 19:06:35 +0000
From: "Loktionov, Aleksandr" <aleksandr.loktionov@...el.com>
To: Alok Tiwari <alok.a.tiwari@...cle.com>, "Kitszel, Przemyslaw"
	<przemyslaw.kitszel@...el.com>, "Lobakin, Aleksander"
	<aleksander.lobakin@...el.com>, "Nguyen, Anthony L"
	<anthony.l.nguyen@...el.com>, "andrew+netdev@...n.ch"
	<andrew+netdev@...n.ch>, "kuba@...nel.org" <kuba@...nel.org>,
	"davem@...emloft.net" <davem@...emloft.net>, "edumazet@...gle.com"
	<edumazet@...gle.com>, "pabeni@...hat.com" <pabeni@...hat.com>,
	"horms@...nel.org" <horms@...nel.org>, "intel-wired-lan@...ts.osuosl.org"
	<intel-wired-lan@...ts.osuosl.org>, "netdev@...r.kernel.org"
	<netdev@...r.kernel.org>
CC: "alok.a.tiwarilinux@...il.com" <alok.a.tiwarilinux@...il.com>
Subject: RE: [Intel-wired-lan] [PATCH net] i40e: fix incorrect src_ip checks
 and memcpy sizes in cloud filter



> -----Original Message-----
> From: Intel-wired-lan <intel-wired-lan-bounces@...osl.org> On Behalf
> Of Alok Tiwari
> Sent: Friday, November 7, 2025 5:10 PM
> To: Kitszel, Przemyslaw <przemyslaw.kitszel@...el.com>; Lobakin,
> Aleksander <aleksander.lobakin@...el.com>; Nguyen, Anthony L
> <anthony.l.nguyen@...el.com>; andrew+netdev@...n.ch; kuba@...nel.org;
> davem@...emloft.net; edumazet@...gle.com; pabeni@...hat.com;
> horms@...nel.org; intel-wired-lan@...ts.osuosl.org;
> netdev@...r.kernel.org
> Cc: alok.a.tiwarilinux@...il.com; alok.a.tiwari@...cle.com
> Subject: [Intel-wired-lan] [PATCH net] i40e: fix incorrect src_ip
> checks and memcpy sizes in cloud filter
> 
If you let me, I'd propose the title:
i40e: fix src IP mask checks and memcpy argument names in cloud filter

> Fix following issues in the IPv4 and IPv6 cloud filter handling logic
> in both the add and delete paths:
> 
> - The source-IP mask check incorrectly compares mask.src_ip[0] against
>   tcf.dst_ip[0]. Update it to compare against tcf.src_ip[0]. This
> likely
>   goes unnoticed because the check is in an "else if" path that only
>   executes when dst_ip is not set, most cloud filter use cases focus
> on
>   destination-IP matching, and the buggy condition can accidentally
>   evaluate true in some cases.
> 
> - memcpy() for the IPv4 source address incorrectly uses
>   ARRAY_SIZE(tcf.dst_ip) instead of ARRAY_SIZE(tcf.src_ip), although
>   both arrays are the same size.
> 
> - In the IPv6 delete path, memcmp() uses sizeof(src_ip6) when
> comparing
>   dst_ip6 fields. Replace this with sizeof(dst_ip6) to make the intent
>   explicit, even though both fields are struct in6_addr.
> 
> Fixes: e284fc280473 ("i40e: Add and delete cloud filter")
> Signed-off-by: Alok Tiwari <alok.a.tiwari@...cle.com>
> ---
>  drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c | 10 +++++-----
>  1 file changed, 5 insertions(+), 5 deletions(-)
> 
> diff --git a/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c
> b/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c
> index 081a4526a2f0..c90cc0139986 100644
> --- a/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c
> +++ b/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c
> @@ -3819,9 +3819,9 @@ static int i40e_vc_del_cloud_filter(struct
> i40e_vf *vf, u8 *msg)
>  		if (mask.dst_ip[0] & tcf.dst_ip[0])
>  			memcpy(&cfilter.ip.v4.dst_ip, tcf.dst_ip,
>  			       ARRAY_SIZE(tcf.dst_ip));
> -		else if (mask.src_ip[0] & tcf.dst_ip[0])
> +		else if (mask.src_ip[0] & tcf.src_ip[0])
>  			memcpy(&cfilter.ip.v4.src_ip, tcf.src_ip,
> -			       ARRAY_SIZE(tcf.dst_ip));
> +			       ARRAY_SIZE(tcf.src_ip));
Please consider the sizeof(field) tweak for memcpy to preempt review nits. 

- memcpy(&cfilter.ip.v4.dst_ip, tcf.dst_ip, ARRAY_SIZE(tcf.dst_ip));
+ memcpy(&cfilter.ip.v4.dst_ip, tcf.dst_ip, sizeof(cfilter.ip.v4.dst_ip));

- memcpy(&cfilter.ip.v4.src_ip, tcf.src_ip, ARRAY_SIZE(tcf.src_ip));
+ memcpy(&cfilter.ip.v4.src_ip, tcf.src_ip, sizeof(cfilter.ip.v4.src_ip));

You have my RB:
Reviewed-by: Aleksandr Loktionov <aleksandr.loktionov@...el.com>

>  		break;
>  	case VIRTCHNL_TCP_V6_FLOW:
>  		cfilter.n_proto = ETH_P_IPV6;
> @@ -3876,7 +3876,7 @@ static int i40e_vc_del_cloud_filter(struct
> i40e_vf *vf, u8 *msg)
>  		/* for ipv6, mask is set for all sixteen bytes (4 words)
> */
>  		if (cfilter.n_proto == ETH_P_IPV6 && mask.dst_ip[3])
>  			if (memcmp(&cfilter.ip.v6.dst_ip6, &cf-
> >ip.v6.dst_ip6,
> -				   sizeof(cfilter.ip.v6.src_ip6)))
> +				   sizeof(cfilter.ip.v6.dst_ip6)))
>  				continue;
>  		if (mask.vlan_id)
>  			if (cfilter.vlan_id != cf->vlan_id)
> @@ -3965,9 +3965,9 @@ static int i40e_vc_add_cloud_filter(struct
> i40e_vf *vf, u8 *msg)
>  		if (mask.dst_ip[0] & tcf.dst_ip[0])
>  			memcpy(&cfilter->ip.v4.dst_ip, tcf.dst_ip,
>  			       ARRAY_SIZE(tcf.dst_ip));
> -		else if (mask.src_ip[0] & tcf.dst_ip[0])
> +		else if (mask.src_ip[0] & tcf.src_ip[0])
>  			memcpy(&cfilter->ip.v4.src_ip, tcf.src_ip,
> -			       ARRAY_SIZE(tcf.dst_ip));
> +			       ARRAY_SIZE(tcf.src_ip));
>  		break;
>  	case VIRTCHNL_TCP_V6_FLOW:
>  		cfilter->n_proto = ETH_P_IPV6;
> --
> 2.50.1