netdev - Re: [Intel-wired-lan] [PATCH net] i40e: fix incorrect src_ip checks and memcpy sizes in cloud filter

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <10160d36-9580-49b5-ac1a-124665c7a396@molgen.mpg.de>
Date: Sun, 9 Nov 2025 15:55:03 +0100
From: Paul Menzel <pmenzel@...gen.mpg.de>
To: Alok Tiwari <alok.a.tiwari@...cle.com>
Cc: przemyslaw.kitszel@...el.com, aleksander.lobakin@...el.com,
 anthony.l.nguyen@...el.com, andrew+netdev@...n.ch, kuba@...nel.org,
 davem@...emloft.net, edumazet@...gle.com, pabeni@...hat.com,
 horms@...nel.org, intel-wired-lan@...ts.osuosl.org, netdev@...r.kernel.org,
 alok.a.tiwarilinux@...il.com
Subject: Re: [Intel-wired-lan] [PATCH net] i40e: fix incorrect src_ip checks
 and memcpy sizes in cloud filter

Dear Alok,


Thank you for the patch.

Am 07.11.25 um 17:09 schrieb Alok Tiwari:
> Fix following issues in the IPv4 and IPv6 cloud filter handling logic in
> both the add and delete paths:
> 
> - The source-IP mask check incorrectly compares mask.src_ip[0] against
>    tcf.dst_ip[0]. Update it to compare against tcf.src_ip[0]. This likely
>    goes unnoticed because the check is in an "else if" path that only
>    executes when dst_ip is not set, most cloud filter use cases focus on
>    destination-IP matching, and the buggy condition can accidentally
>    evaluate true in some cases.

Do you have a reproducer?

> - memcpy() for the IPv4 source address incorrectly uses
>    ARRAY_SIZE(tcf.dst_ip) instead of ARRAY_SIZE(tcf.src_ip), although
>    both arrays are the same size.
> 
> - In the IPv6 delete path, memcmp() uses sizeof(src_ip6) when comparing
>    dst_ip6 fields. Replace this with sizeof(dst_ip6) to make the intent
>    explicit, even though both fields are struct in6_addr.
> 
> Fixes: e284fc280473 ("i40e: Add and delete cloud filter")
> Signed-off-by: Alok Tiwari <alok.a.tiwari@...cle.com>
> ---
>   drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c | 10 +++++-----
>   1 file changed, 5 insertions(+), 5 deletions(-)
> 
> diff --git a/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c b/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c
> index 081a4526a2f0..c90cc0139986 100644
> --- a/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c
> +++ b/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c
> @@ -3819,9 +3819,9 @@ static int i40e_vc_del_cloud_filter(struct i40e_vf *vf, u8 *msg)
>   		if (mask.dst_ip[0] & tcf.dst_ip[0])
>   			memcpy(&cfilter.ip.v4.dst_ip, tcf.dst_ip,
>   			       ARRAY_SIZE(tcf.dst_ip));
> -		else if (mask.src_ip[0] & tcf.dst_ip[0])
> +		else if (mask.src_ip[0] & tcf.src_ip[0])
>   			memcpy(&cfilter.ip.v4.src_ip, tcf.src_ip,
> -			       ARRAY_SIZE(tcf.dst_ip));
> +			       ARRAY_SIZE(tcf.src_ip));
>   		break;
>   	case VIRTCHNL_TCP_V6_FLOW:
>   		cfilter.n_proto = ETH_P_IPV6;
> @@ -3876,7 +3876,7 @@ static int i40e_vc_del_cloud_filter(struct i40e_vf *vf, u8 *msg)
>   		/* for ipv6, mask is set for all sixteen bytes (4 words) */
>   		if (cfilter.n_proto == ETH_P_IPV6 && mask.dst_ip[3])
>   			if (memcmp(&cfilter.ip.v6.dst_ip6, &cf->ip.v6.dst_ip6,
> -				   sizeof(cfilter.ip.v6.src_ip6)))
> +				   sizeof(cfilter.ip.v6.dst_ip6)))
>   				continue;
>   		if (mask.vlan_id)
>   			if (cfilter.vlan_id != cf->vlan_id)
> @@ -3965,9 +3965,9 @@ static int i40e_vc_add_cloud_filter(struct i40e_vf *vf, u8 *msg)
>   		if (mask.dst_ip[0] & tcf.dst_ip[0])
>   			memcpy(&cfilter->ip.v4.dst_ip, tcf.dst_ip,
>   			       ARRAY_SIZE(tcf.dst_ip));
> -		else if (mask.src_ip[0] & tcf.dst_ip[0])
> +		else if (mask.src_ip[0] & tcf.src_ip[0])
>   			memcpy(&cfilter->ip.v4.src_ip, tcf.src_ip,
> -			       ARRAY_SIZE(tcf.dst_ip));
> +			       ARRAY_SIZE(tcf.src_ip));
>   		break;
>   	case VIRTCHNL_TCP_V6_FLOW:
>   		cfilter->n_proto = ETH_P_IPV6;

Reviewed-by: Paul Menzel <pmenzel@...gen.mpg.de>


Kind regards,

Paul