All of lore.kernel.org
 help / color / mirror / Atom feed
From: Saeed Mahameed <saeed@kernel.org>
To: "David S. Miller" <davem@davemloft.net>,
	Jakub Kicinski <kuba@kernel.org>
Cc: netdev@vger.kernel.org, Yevgeny Kliteynik <kliteyn@nvidia.com>,
	Saeed Mahameed <saeedm@nvidia.com>
Subject: [net 06/12] net/mlx5: DR, Fix check for unsupported fields in match param
Date: Tue, 16 Nov 2021 12:23:15 -0800	[thread overview]
Message-ID: <20211116202321.283874-7-saeed@kernel.org> (raw)
In-Reply-To: <20211116202321.283874-1-saeed@kernel.org>

From: Yevgeny Kliteynik <kliteyn@nvidia.com>

The existing loop doesn't cast the buffer while scanning it, which
results in out-of-bounds read and failure to create the matcher.

Fixes: 941f19798a11 ("net/mlx5: DR, Add check for unsupported fields in match param")
Signed-off-by: Yevgeny Kliteynik <kliteyn@nvidia.com>
Signed-off-by: Saeed Mahameed <saeedm@nvidia.com>
---
 .../ethernet/mellanox/mlx5/core/steering/dr_matcher.c | 11 ++++++-----
 1 file changed, 6 insertions(+), 5 deletions(-)

diff --git a/drivers/net/ethernet/mellanox/mlx5/core/steering/dr_matcher.c b/drivers/net/ethernet/mellanox/mlx5/core/steering/dr_matcher.c
index 75c775bee351..793365242e85 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/steering/dr_matcher.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/steering/dr_matcher.c
@@ -924,11 +924,12 @@ static int dr_matcher_init(struct mlx5dr_matcher *matcher,
 
 	/* Check that all mask data was consumed */
 	for (i = 0; i < consumed_mask.match_sz; i++) {
-		if (consumed_mask.match_buf[i]) {
-			mlx5dr_dbg(dmn, "Match param mask contains unsupported parameters\n");
-			ret = -EOPNOTSUPP;
-			goto free_consumed_mask;
-		}
+		if (!((u8 *)consumed_mask.match_buf)[i])
+			continue;
+
+		mlx5dr_dbg(dmn, "Match param mask contains unsupported parameters\n");
+		ret = -EOPNOTSUPP;
+		goto free_consumed_mask;
 	}
 
 	ret =  0;
-- 
2.31.1


  parent reply	other threads:[~2021-11-16 20:23 UTC|newest]

Thread overview: 14+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2021-11-16 20:23 [pull request][net 00/12] mlx5 fixes 2021-11-16 Saeed Mahameed
2021-11-16 20:23 ` [net 01/12] net/mlx5e: kTLS, Fix crash in RX resync flow Saeed Mahameed
2021-11-17 11:10   ` patchwork-bot+netdevbpf
2021-11-16 20:23 ` [net 02/12] net/mlx5e: Wait for concurrent flow deletion during neigh/fib events Saeed Mahameed
2021-11-16 20:23 ` [net 03/12] net/mlx5: E-Switch, Fix resetting of encap mode when entering switchdev Saeed Mahameed
2021-11-16 20:23 ` [net 04/12] net/mlx5e: nullify cq->dbg pointer in mlx5_debug_cq_remove() Saeed Mahameed
2021-11-16 20:23 ` [net 05/12] net/mlx5: DR, Handle eswitch manager and uplink vports separately Saeed Mahameed
2021-11-16 20:23 ` Saeed Mahameed [this message]
2021-11-16 20:23 ` [net 07/12] net/mlx5: Update error handler for UCTX and UMEM Saeed Mahameed
2021-11-16 20:23 ` [net 08/12] net/mlx5: E-Switch, rebuild lag only when needed Saeed Mahameed
2021-11-16 20:23 ` [net 09/12] net/mlx5: Fix flow counters SF bulk query len Saeed Mahameed
2021-11-16 20:23 ` [net 10/12] net/mlx5e: CT, Fix multiple allocations and memleak of mod acts Saeed Mahameed
2021-11-16 20:23 ` [net 11/12] net/mlx5: Lag, update tracker when state change event received Saeed Mahameed
2021-11-16 20:23 ` [net 12/12] net/mlx5: E-Switch, return error if encap isn't supported Saeed Mahameed

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20211116202321.283874-7-saeed@kernel.org \
    --to=saeed@kernel.org \
    --cc=davem@davemloft.net \
    --cc=kliteyn@nvidia.com \
    --cc=kuba@kernel.org \
    --cc=netdev@vger.kernel.org \
    --cc=saeedm@nvidia.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.