* [PATCH net-next] sfc: ensure type is valid before updating seen_gen
@ 2022-11-21 21:37 edward.cree
2022-11-23 5:17 ` Kees Cook
2022-11-23 13:50 ` patchwork-bot+netdevbpf
0 siblings, 2 replies; 3+ messages in thread
From: edward.cree @ 2022-11-21 21:37 UTC (permalink / raw)
To: netdev, linux-net-drivers
Cc: davem, kuba, pabeni, edumazet, habetsm.xilinx, Edward Cree, coverity-bot
From: Edward Cree <ecree.xilinx@gmail.com>
In the case of invalid or corrupted v2 counter update packets,
efx_tc_rx_version_2() returns EFX_TC_COUNTER_TYPE_MAX. In this case
we should not attempt to update generation counts as this will write
beyond the end of the seen_gen array.
Reported-by: coverity-bot <keescook+coverity-bot@chromium.org>
Addresses-Coverity-ID: 1527356 ("Memory - illegal accesses")
Fixes: 25730d8be5d8 ("sfc: add extra RX channel to receive MAE counter updates on ef100")
Signed-off-by: Edward Cree <ecree.xilinx@gmail.com>
---
drivers/net/ethernet/sfc/tc_counters.c | 16 +++++++++-------
1 file changed, 9 insertions(+), 7 deletions(-)
diff --git a/drivers/net/ethernet/sfc/tc_counters.c b/drivers/net/ethernet/sfc/tc_counters.c
index 2bba5d3a2fdb..d1a91d54c6bb 100644
--- a/drivers/net/ethernet/sfc/tc_counters.c
+++ b/drivers/net/ethernet/sfc/tc_counters.c
@@ -476,13 +476,15 @@ static bool efx_tc_rx(struct efx_rx_queue *rx_queue, u32 mark)
goto out;
}
- /* Update seen_gen unconditionally, to avoid a missed wakeup if
- * we race with efx_mae_stop_counters().
- */
- efx->tc->seen_gen[type] = mark;
- if (efx->tc->flush_counters &&
- (s32)(efx->tc->flush_gen[type] - mark) <= 0)
- wake_up(&efx->tc->flush_wq);
+ if (type < EFX_TC_COUNTER_TYPE_MAX) {
+ /* Update seen_gen unconditionally, to avoid a missed wakeup if
+ * we race with efx_mae_stop_counters().
+ */
+ efx->tc->seen_gen[type] = mark;
+ if (efx->tc->flush_counters &&
+ (s32)(efx->tc->flush_gen[type] - mark) <= 0)
+ wake_up(&efx->tc->flush_wq);
+ }
out:
efx_free_rx_buffers(rx_queue, rx_buf, 1);
channel->rx_pkt_n_frags = 0;
^ permalink raw reply related [flat|nested] 3+ messages in thread
* Re: [PATCH net-next] sfc: ensure type is valid before updating seen_gen
2022-11-21 21:37 [PATCH net-next] sfc: ensure type is valid before updating seen_gen edward.cree
@ 2022-11-23 5:17 ` Kees Cook
2022-11-23 13:50 ` patchwork-bot+netdevbpf
1 sibling, 0 replies; 3+ messages in thread
From: Kees Cook @ 2022-11-23 5:17 UTC (permalink / raw)
To: edward.cree
Cc: netdev, linux-net-drivers, davem, kuba, pabeni, edumazet,
habetsm.xilinx, Edward Cree
On Mon, Nov 21, 2022 at 09:37:08PM +0000, edward.cree@amd.com wrote:
> From: Edward Cree <ecree.xilinx@gmail.com>
>
> In the case of invalid or corrupted v2 counter update packets,
> efx_tc_rx_version_2() returns EFX_TC_COUNTER_TYPE_MAX. In this case
> we should not attempt to update generation counts as this will write
> beyond the end of the seen_gen array.
>
> Reported-by: coverity-bot <keescook+coverity-bot@chromium.org>
> Addresses-Coverity-ID: 1527356 ("Memory - illegal accesses")
> Fixes: 25730d8be5d8 ("sfc: add extra RX channel to receive MAE counter updates on ef100")
> Signed-off-by: Edward Cree <ecree.xilinx@gmail.com>
Reviewed-by: Kees Cook <keescook@chromium.org>
--
Kees Cook
^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: [PATCH net-next] sfc: ensure type is valid before updating seen_gen
2022-11-21 21:37 [PATCH net-next] sfc: ensure type is valid before updating seen_gen edward.cree
2022-11-23 5:17 ` Kees Cook
@ 2022-11-23 13:50 ` patchwork-bot+netdevbpf
1 sibling, 0 replies; 3+ messages in thread
From: patchwork-bot+netdevbpf @ 2022-11-23 13:50 UTC (permalink / raw)
To: edward.cree
Cc: netdev, linux-net-drivers, davem, kuba, pabeni, edumazet,
habetsm.xilinx, ecree.xilinx, keescook+coverity-bot
Hello:
This patch was applied to netdev/net-next.git (master)
by David S. Miller <davem@davemloft.net>:
On Mon, 21 Nov 2022 21:37:08 +0000 you wrote:
> From: Edward Cree <ecree.xilinx@gmail.com>
>
> In the case of invalid or corrupted v2 counter update packets,
> efx_tc_rx_version_2() returns EFX_TC_COUNTER_TYPE_MAX. In this case
> we should not attempt to update generation counts as this will write
> beyond the end of the seen_gen array.
>
> [...]
Here is the summary with links:
- [net-next] sfc: ensure type is valid before updating seen_gen
https://git.kernel.org/netdev/net-next/c/e80bd08fd75a
You are awesome, thank you!
--
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2022-11-23 13:56 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2022-11-21 21:37 [PATCH net-next] sfc: ensure type is valid before updating seen_gen edward.cree
2022-11-23 5:17 ` Kees Cook
2022-11-23 13:50 ` patchwork-bot+netdevbpf
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).