* [PATCH net] net: dsa: bcm_sf2: Fix RX_CLS_LOC_ANY overwrite for last rule
@ 2018-05-11 23:24 Florian Fainelli
2018-05-11 23:38 ` Florian Fainelli
0 siblings, 1 reply; 3+ messages in thread
From: Florian Fainelli @ 2018-05-11 23:24 UTC (permalink / raw)
To: netdev
Cc: Florian Fainelli, Andrew Lunn, Vivien Didelot, David S. Miller,
open list
When we let the kernel pick up a rule location with RX_CLS_LOC_ANY, we
would be able to overwrite the last rules because of a number of issues:
- the IPv4 code path would not be checking that rule_index is within
bounds, the IPv6 code path would only be checking the second index and
not the first one
- find_first_zero_bit() needs to operate on the full bitmap size
(priv->num_cfp_rules) otherwise it would be off by one in the results
it returns and the checks against bcm_sf2_cfp_rule_size() would be non
functioning
Fixes: 3306145866b6 ("net: dsa: bcm_sf2: Move IPv4 CFP processing to specific functions")
Fixes: ba0696c22e7c ("net: dsa: bcm_sf2: Add support for IPv6 CFP rules")
Signed-off-by: Florian Fainelli <f.fainelli@gmail.com>
---
drivers/net/dsa/bcm_sf2_cfp.c | 11 ++++++++---
1 file changed, 8 insertions(+), 3 deletions(-)
diff --git a/drivers/net/dsa/bcm_sf2_cfp.c b/drivers/net/dsa/bcm_sf2_cfp.c
index 23b45da784cb..ade5fa3d747d 100644
--- a/drivers/net/dsa/bcm_sf2_cfp.c
+++ b/drivers/net/dsa/bcm_sf2_cfp.c
@@ -354,10 +354,13 @@ static int bcm_sf2_cfp_ipv4_rule_set(struct bcm_sf2_priv *priv, int port,
/* Locate the first rule available */
if (fs->location == RX_CLS_LOC_ANY)
rule_index = find_first_zero_bit(priv->cfp.used,
- bcm_sf2_cfp_rule_size(priv));
+ priv->num_cfp_rules);
else
rule_index = fs->location;
+ if (rule_index > bcm_sf2_cfp_rule_size(priv))
+ return -ENOSPC;
+
layout = &udf_tcpip4_layout;
/* We only use one UDF slice for now */
slice_num = bcm_sf2_get_slice_number(layout, 0);
@@ -563,9 +566,11 @@ static int bcm_sf2_cfp_ipv6_rule_set(struct bcm_sf2_priv *priv, int port,
*/
if (fs->location == RX_CLS_LOC_ANY)
rule_index[0] = find_first_zero_bit(priv->cfp.used,
- bcm_sf2_cfp_rule_size(priv));
+ priv->num_cfp_rules);
else
rule_index[0] = fs->location;
+ if (rule_index[0] > bcm_sf2_cfp_rule_size(priv))
+ return -ENOSPC;
/* Flag it as used (cleared on error path) such that we can immediately
* obtain a second one to chain from.
@@ -573,7 +578,7 @@ static int bcm_sf2_cfp_ipv6_rule_set(struct bcm_sf2_priv *priv, int port,
set_bit(rule_index[0], priv->cfp.used);
rule_index[1] = find_first_zero_bit(priv->cfp.used,
- bcm_sf2_cfp_rule_size(priv));
+ priv->num_cfp_rules);
if (rule_index[1] > bcm_sf2_cfp_rule_size(priv)) {
ret = -ENOSPC;
goto out_err;
--
2.14.1
^ permalink raw reply related [flat|nested] 3+ messages in thread
* Re: [PATCH net] net: dsa: bcm_sf2: Fix RX_CLS_LOC_ANY overwrite for last rule
2018-05-11 23:24 [PATCH net] net: dsa: bcm_sf2: Fix RX_CLS_LOC_ANY overwrite for last rule Florian Fainelli
@ 2018-05-11 23:38 ` Florian Fainelli
2018-05-12 0:03 ` David Miller
0 siblings, 1 reply; 3+ messages in thread
From: Florian Fainelli @ 2018-05-11 23:38 UTC (permalink / raw)
To: netdev, David S. Miller; +Cc: Andrew Lunn, Vivien Didelot, open list
On 05/11/2018 04:24 PM, Florian Fainelli wrote:
> When we let the kernel pick up a rule location with RX_CLS_LOC_ANY, we
> would be able to overwrite the last rules because of a number of issues:
>
> - the IPv4 code path would not be checking that rule_index is within
> bounds, the IPv6 code path would only be checking the second index and
> not the first one
>
> - find_first_zero_bit() needs to operate on the full bitmap size
> (priv->num_cfp_rules) otherwise it would be off by one in the results
> it returns and the checks against bcm_sf2_cfp_rule_size() would be non
> functioning
>
> Fixes: 3306145866b6 ("net: dsa: bcm_sf2: Move IPv4 CFP processing to specific functions")
> Fixes: ba0696c22e7c ("net: dsa: bcm_sf2: Add support for IPv6 CFP rules")
> Signed-off-by: Florian Fainelli <f.fainelli@gmail.com>
David, please discard that for now, the IPv4 part is correct, but I am
not fixing the bug correctly for the IPv6 part. v2 coming some time next
week. Thank you!
--
Florian
^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: [PATCH net] net: dsa: bcm_sf2: Fix RX_CLS_LOC_ANY overwrite for last rule
2018-05-11 23:38 ` Florian Fainelli
@ 2018-05-12 0:03 ` David Miller
0 siblings, 0 replies; 3+ messages in thread
From: David Miller @ 2018-05-12 0:03 UTC (permalink / raw)
To: f.fainelli; +Cc: netdev, andrew, vivien.didelot, linux-kernel
From: Florian Fainelli <f.fainelli@gmail.com>
Date: Fri, 11 May 2018 16:38:02 -0700
> David, please discard that for now, the IPv4 part is correct, but I am
> not fixing the bug correctly for the IPv6 part. v2 coming some time next
> week. Thank you!
Ok.
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2018-05-12 0:03 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2018-05-11 23:24 [PATCH net] net: dsa: bcm_sf2: Fix RX_CLS_LOC_ANY overwrite for last rule Florian Fainelli
2018-05-11 23:38 ` Florian Fainelli
2018-05-12 0:03 ` David Miller
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).