[PATCH bpf] nfp: bpf: allow zero-length capabilities

[PATCH bpf] nfp: bpf: allow zero-length capabilities

[Jakub Kicinski]

Some BPF capabilities carry no value, they simply indicate feature
is present.  Our capability parsing loop will exit early if last
capability is zero-length because it's looking for more than 8 bytes
of data (8B is our TLV header length).  Allow the last capability to
be zero-length.

This bug would lead to driver failing to probe with the following error
if the last capability FW advertises is zero-length:

    nfp: BPF capabilities left after parsing, parsed:92 total length:100
    nfp: invalid BPF capabilities at offset:92

Note the "parsed" and "length" values are 8 apart.

No shipping FW runs into this issue, but we can't guarantee that will
remain the case.

Fixes: 77a844ee650c ("nfp: bpf: prepare for parsing BPF FW capabilities")
Signed-off-by: Jakub Kicinski <jakub.kicinski@netronome.com>
Reviewed-by: Quentin Monnet <quentin.monnet@netronome.com>
---
 drivers/net/ethernet/netronome/nfp/bpf/main.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/net/ethernet/netronome/nfp/bpf/main.c b/drivers/net/ethernet/netronome/nfp/bpf/main.c
index 1dc424685f4e..35fb31f682af 100644
--- a/drivers/net/ethernet/netronome/nfp/bpf/main.c
+++ b/drivers/net/ethernet/netronome/nfp/bpf/main.c
@@ -335,7 +335,7 @@ static int nfp_bpf_parse_capabilities(struct nfp_app *app)
 		return PTR_ERR(mem) == -ENOENT ? 0 : PTR_ERR(mem);
 
 	start = mem;
-	while (mem - start + 8 < nfp_cpp_area_size(area)) {
+	while (mem - start + 8 <= nfp_cpp_area_size(area)) {
 		u8 __iomem *value;
 		u32 type, length;
 
-- 
2.17.0

Re: [PATCH bpf] nfp: bpf: allow zero-length capabilities

[Daniel Borkmann]

On 05/09/2018 04:42 AM, Jakub Kicinski wrote:
> Some BPF capabilities carry no value, they simply indicate feature
> is present.  Our capability parsing loop will exit early if last
> capability is zero-length because it's looking for more than 8 bytes
> of data (8B is our TLV header length).  Allow the last capability to
> be zero-length.
> 
> This bug would lead to driver failing to probe with the following error
> if the last capability FW advertises is zero-length:
> 
>     nfp: BPF capabilities left after parsing, parsed:92 total length:100
>     nfp: invalid BPF capabilities at offset:92
> 
> Note the "parsed" and "length" values are 8 apart.
> 
> No shipping FW runs into this issue, but we can't guarantee that will
> remain the case.
> 
> Fixes: 77a844ee650c ("nfp: bpf: prepare for parsing BPF FW capabilities")
> Signed-off-by: Jakub Kicinski <jakub.kicinski@netronome.com>
> Reviewed-by: Quentin Monnet <quentin.monnet@netronome.com>

Applied to bpf tree, thanks!