netdev.vger.kernel.org archive mirror
 help / color / mirror / Atom feed
* [PATCH net 0/3] net: hns3: fixes for -net
@ 2021-02-09  9:03 Huazhong Tan
  2021-02-09  9:03 ` [PATCH net 1/3] net: hns3: add a check for queue_id in hclge_reset_vf_queue() Huazhong Tan
                   ` (4 more replies)
  0 siblings, 5 replies; 6+ messages in thread
From: Huazhong Tan @ 2021-02-09  9:03 UTC (permalink / raw)
  To: davem, kuba
  Cc: netdev, salil.mehta, yisen.zhuang, huangdaode, linuxarm, Huazhong Tan

The parameters sent from vf may be unreliable. If these
parameters are used directly, memory overwriting may occur.

So this series adds some checks for this case.

Yufeng Mo (3):
  net: hns3: add a check for queue_id in hclge_reset_vf_queue()
  net: hns3: add a check for tqp_index in
    hclge_get_ring_chain_from_mbx()
  net: hns3: add a check for index in hclge_get_rss_key()

 .../ethernet/hisilicon/hns3/hns3pf/hclge_main.c    |  7 ++++++
 .../net/ethernet/hisilicon/hns3/hns3pf/hclge_mbx.c | 29 +++++++++++++++++++---
 2 files changed, 32 insertions(+), 4 deletions(-)

-- 
2.7.4


^ permalink raw reply	[flat|nested] 6+ messages in thread
* [PATCH net 1/3] net: hns3: add a check for queue_id in hclge_reset_vf_queue()
  2021-02-09  9:03 [PATCH net 0/3] net: hns3: fixes for -net Huazhong Tan
@ 2021-02-09  9:03 ` Huazhong Tan
  2021-02-09  9:03 ` [PATCH net 2/3] net: hns3: add a check for tqp_index in hclge_get_ring_chain_from_mbx() Huazhong Tan
                   ` (3 subsequent siblings)
  4 siblings, 0 replies; 6+ messages in thread
From: Huazhong Tan @ 2021-02-09  9:03 UTC (permalink / raw)
  To: davem, kuba
  Cc: netdev, salil.mehta, yisen.zhuang, huangdaode, linuxarm,
	Yufeng Mo, Huazhong Tan

From: Yufeng Mo <moyufeng@huawei.com>

The queue_id is received from vf, if use it directly,
an out-of-bound issue may be caused, so add a check for
this queue_id before using it in hclge_reset_vf_queue().

Fixes: 1a426f8b40fc ("net: hns3: fix the VF queue reset flow error")
Signed-off-by: Yufeng Mo <moyufeng@huawei.com>
Signed-off-by: Huazhong Tan <tanhuazhong@huawei.com>
---
 drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c
index c242883..48549db 100644
--- a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c
+++ b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c
@@ -9813,12 +9813,19 @@ int hclge_reset_tqp(struct hnae3_handle *handle, u16 queue_id)
 
 void hclge_reset_vf_queue(struct hclge_vport *vport, u16 queue_id)
 {
+	struct hnae3_handle *handle = &vport->nic;
 	struct hclge_dev *hdev = vport->back;
 	int reset_try_times = 0;
 	int reset_status;
 	u16 queue_gid;
 	int ret;
 
+	if (queue_id >= handle->kinfo.num_tqps) {
+		dev_warn(&hdev->pdev->dev, "Invalid vf queue id(%u)\n",
+			 queue_id);
+		return;
+	}
+
 	queue_gid = hclge_covert_handle_qid_global(&vport->nic, queue_id);
 
 	ret = hclge_send_reset_tqp_cmd(hdev, queue_gid, true);
-- 
2.7.4


^ permalink raw reply related	[flat|nested] 6+ messages in thread
* [PATCH net 2/3] net: hns3: add a check for tqp_index in hclge_get_ring_chain_from_mbx()
  2021-02-09  9:03 [PATCH net 0/3] net: hns3: fixes for -net Huazhong Tan
  2021-02-09  9:03 ` [PATCH net 1/3] net: hns3: add a check for queue_id in hclge_reset_vf_queue() Huazhong Tan
@ 2021-02-09  9:03 ` Huazhong Tan
  2021-02-09  9:03 ` [PATCH net 3/3] net: hns3: add a check for index in hclge_get_rss_key() Huazhong Tan
                   ` (2 subsequent siblings)
  4 siblings, 0 replies; 6+ messages in thread
From: Huazhong Tan @ 2021-02-09  9:03 UTC (permalink / raw)
  To: davem, kuba
  Cc: netdev, salil.mehta, yisen.zhuang, huangdaode, linuxarm,
	Yufeng Mo, Huazhong Tan

From: Yufeng Mo <moyufeng@huawei.com>

The tqp_index is received from vf, if use it directly,
an out-of-bound issue may be caused, so add a check for
this tqp_index before using it in hclge_get_ring_chain_from_mbx().

Fixes: 84e095d64ed9 ("net: hns3: Change PF to add ring-vect binding & resetQ to mailbox")
Signed-off-by: Yufeng Mo <moyufeng@huawei.com>
Signed-off-by: Huazhong Tan <tanhuazhong@huawei.com>
---
 drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_mbx.c | 18 ++++++++++++++----
 1 file changed, 14 insertions(+), 4 deletions(-)

diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_mbx.c b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_mbx.c
index 754c09a..ea2dea99 100644
--- a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_mbx.c
+++ b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_mbx.c
@@ -158,21 +158,31 @@ static int hclge_get_ring_chain_from_mbx(
 			struct hclge_vport *vport)
 {
 	struct hnae3_ring_chain_node *cur_chain, *new_chain;
+	struct hclge_dev *hdev = vport->back;
 	int ring_num;
-	int i = 0;
+	int i;
 
 	ring_num = req->msg.ring_num;
 
 	if (ring_num > HCLGE_MBX_MAX_RING_CHAIN_PARAM_NUM)
 		return -ENOMEM;
 
+	for (i = 0; i < ring_num; i++) {
+		if (req->msg.param[i].tqp_index >= vport->nic.kinfo.rss_size) {
+			dev_err(&hdev->pdev->dev, "tqp index(%u) is out of range(0-%u)\n",
+				req->msg.param[i].tqp_index,
+				vport->nic.kinfo.rss_size - 1);
+			return -EINVAL;
+		}
+	}
+
 	hnae3_set_bit(ring_chain->flag, HNAE3_RING_TYPE_B,
-		      req->msg.param[i].ring_type);
+		      req->msg.param[0].ring_type);
 	ring_chain->tqp_index =
 		hclge_get_queue_id(vport->nic.kinfo.tqp
-				   [req->msg.param[i].tqp_index]);
+				   [req->msg.param[0].tqp_index]);
 	hnae3_set_field(ring_chain->int_gl_idx, HNAE3_RING_GL_IDX_M,
-			HNAE3_RING_GL_IDX_S, req->msg.param[i].int_gl_index);
+			HNAE3_RING_GL_IDX_S, req->msg.param[0].int_gl_index);
 
 	cur_chain = ring_chain;
 
-- 
2.7.4


^ permalink raw reply related	[flat|nested] 6+ messages in thread
* [PATCH net 3/3] net: hns3: add a check for index in hclge_get_rss_key()
  2021-02-09  9:03 [PATCH net 0/3] net: hns3: fixes for -net Huazhong Tan
  2021-02-09  9:03 ` [PATCH net 1/3] net: hns3: add a check for queue_id in hclge_reset_vf_queue() Huazhong Tan
  2021-02-09  9:03 ` [PATCH net 2/3] net: hns3: add a check for tqp_index in hclge_get_ring_chain_from_mbx() Huazhong Tan
@ 2021-02-09  9:03 ` Huazhong Tan
  2021-02-09 18:18 ` [PATCH net 0/3] net: hns3: fixes for -net Jakub Kicinski
  2021-02-09 23:30 ` patchwork-bot+netdevbpf
  4 siblings, 0 replies; 6+ messages in thread
From: Huazhong Tan @ 2021-02-09  9:03 UTC (permalink / raw)
  To: davem, kuba
  Cc: netdev, salil.mehta, yisen.zhuang, huangdaode, linuxarm,
	Yufeng Mo, Huazhong Tan

From: Yufeng Mo <moyufeng@huawei.com>

The index is received from vf, if use it directly,
an out-of-bound issue may be caused, so add a check for
this index before using it in hclge_get_rss_key().

Fixes: a638b1d8cc87 ("net: hns3: fix get VF RSS issue")
Signed-off-by: Yufeng Mo <moyufeng@huawei.com>
Signed-off-by: Huazhong Tan <tanhuazhong@huawei.com>
---
 drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_mbx.c | 11 +++++++++++
 1 file changed, 11 insertions(+)

diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_mbx.c b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_mbx.c
index ea2dea99..ffb416e 100644
--- a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_mbx.c
+++ b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_mbx.c
@@ -607,6 +607,17 @@ static void hclge_get_rss_key(struct hclge_vport *vport,
 
 	index = mbx_req->msg.data[0];
 
+	/* Check the query index of rss_hash_key from VF, make sure no
+	 * more than the size of rss_hash_key.
+	 */
+	if (((index + 1) * HCLGE_RSS_MBX_RESP_LEN) >
+	      sizeof(vport[0].rss_hash_key)) {
+		dev_warn(&hdev->pdev->dev,
+			 "failed to get the rss hash key, the index(%u) invalid !\n",
+			 index);
+		return;
+	}
+
 	memcpy(resp_msg->data,
 	       &hdev->vport[0].rss_hash_key[index * HCLGE_RSS_MBX_RESP_LEN],
 	       HCLGE_RSS_MBX_RESP_LEN);
-- 
2.7.4


^ permalink raw reply related	[flat|nested] 6+ messages in thread
* Re: [PATCH net 0/3] net: hns3: fixes for -net
  2021-02-09  9:03 [PATCH net 0/3] net: hns3: fixes for -net Huazhong Tan
                   ` (2 preceding siblings ...)
  2021-02-09  9:03 ` [PATCH net 3/3] net: hns3: add a check for index in hclge_get_rss_key() Huazhong Tan
@ 2021-02-09 18:18 ` Jakub Kicinski
  2021-02-09 23:30 ` patchwork-bot+netdevbpf
  4 siblings, 0 replies; 6+ messages in thread
From: Jakub Kicinski @ 2021-02-09 18:18 UTC (permalink / raw)
  To: Huazhong Tan
  Cc: davem, netdev, salil.mehta, yisen.zhuang, huangdaode, linuxarm

On Tue, 9 Feb 2021 17:03:04 +0800 Huazhong Tan wrote:
> The parameters sent from vf may be unreliable. If these
> parameters are used directly, memory overwriting may occur.

Acked-by: Jakub Kicinski <kuba@kernel.org>

^ permalink raw reply	[flat|nested] 6+ messages in thread
* Re: [PATCH net 0/3] net: hns3: fixes for -net
  2021-02-09  9:03 [PATCH net 0/3] net: hns3: fixes for -net Huazhong Tan
                   ` (3 preceding siblings ...)
  2021-02-09 18:18 ` [PATCH net 0/3] net: hns3: fixes for -net Jakub Kicinski
@ 2021-02-09 23:30 ` patchwork-bot+netdevbpf
  4 siblings, 0 replies; 6+ messages in thread
From: patchwork-bot+netdevbpf @ 2021-02-09 23:30 UTC (permalink / raw)
  To: Huazhong Tan
  Cc: davem, kuba, netdev, salil.mehta, yisen.zhuang, huangdaode, linuxarm

Hello:

This series was applied to netdev/net.git (refs/heads/master):

On Tue, 9 Feb 2021 17:03:04 +0800 you wrote:
> The parameters sent from vf may be unreliable. If these
> parameters are used directly, memory overwriting may occur.
> 
> So this series adds some checks for this case.
> 
> Yufeng Mo (3):
>   net: hns3: add a check for queue_id in hclge_reset_vf_queue()
>   net: hns3: add a check for tqp_index in
>     hclge_get_ring_chain_from_mbx()
>   net: hns3: add a check for index in hclge_get_rss_key()
> 
> [...]

Here is the summary with links:
  - [net,1/3] net: hns3: add a check for queue_id in hclge_reset_vf_queue()
    https://git.kernel.org/netdev/net/c/67a69f84cab6
  - [net,2/3] net: hns3: add a check for tqp_index in hclge_get_ring_chain_from_mbx()
    https://git.kernel.org/netdev/net/c/326334aad024
  - [net,3/3] net: hns3: add a check for index in hclge_get_rss_key()
    https://git.kernel.org/netdev/net/c/532cfc0df1e4

You are awesome, thank you!
--
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html



^ permalink raw reply	[flat|nested] 6+ messages in thread
end of thread, other threads:[~2021-02-10  0:08 UTC | newest]

Thread overview: 6+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2021-02-09  9:03 [PATCH net 0/3] net: hns3: fixes for -net Huazhong Tan
2021-02-09  9:03 ` [PATCH net 1/3] net: hns3: add a check for queue_id in hclge_reset_vf_queue() Huazhong Tan
2021-02-09  9:03 ` [PATCH net 2/3] net: hns3: add a check for tqp_index in hclge_get_ring_chain_from_mbx() Huazhong Tan
2021-02-09  9:03 ` [PATCH net 3/3] net: hns3: add a check for index in hclge_get_rss_key() Huazhong Tan
2021-02-09 18:18 ` [PATCH net 0/3] net: hns3: fixes for -net Jakub Kicinski
2021-02-09 23:30 ` patchwork-bot+netdevbpf

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).