From: Kishore Padmanabha <[email protected]>
Two independent out-of-bounds issues:
- match_vnic_rss_cfg() indexed bp->rx_queues[] with firmware/
application-supplied RSS queue IDs without validating them against
bp->rx_nr_rings first, and dereferenced the resulting (possibly
NULL) queue pointer unconditionally.
- bnxt_init_ctx_initializer() computed ctxm->init_offset from a
firmware-supplied byte offset without checking it against the
context entry's own size, allowing an out-of-range init offset to
be used later when initializing backing-store entries.
Fixes: adc0f81c6552 ("net/bnxt: support RSS action")
Fixes: fe2f715ca580 ("net/bnxt: support backing store v2")
Cc: [email protected]
Signed-off-by: Kishore Padmanabha <[email protected]>
Signed-off-by: Mohammad Shuab Siddique <[email protected]>
---
drivers/net/bnxt/bnxt_flow.c | 13 +++++++++++++
drivers/net/bnxt/bnxt_hwrm.c | 14 +++++++++++---
2 files changed, 24 insertions(+), 3 deletions(-)
diff --git a/drivers/net/bnxt/bnxt_flow.c b/drivers/net/bnxt/bnxt_flow.c
index a2e590540b..12d21c4853 100644
--- a/drivers/net/bnxt/bnxt_flow.c
+++ b/drivers/net/bnxt/bnxt_flow.c
@@ -968,10 +968,23 @@ static int match_vnic_rss_cfg(struct bnxt *bp,
{
unsigned int match = 0, i;
+ if (rss->queue_num > bp->rx_nr_rings)
+ return -EINVAL;
+
if (vnic->rx_queue_cnt != rss->queue_num)
return -EINVAL;
for (i = 0; i < rss->queue_num; i++) {
+ if (rss->queue[i] >= bp->rx_nr_rings) {
+ PMD_DRV_LOG_LINE(ERR, "Queue ID %u for RSS exceeds ring
count %u",
+ rss->queue[i], bp->rx_nr_rings);
+ return -EINVAL;
+ }
+ if (!bp->rx_queues[rss->queue[i]]) {
+ PMD_DRV_LOG_LINE(ERR, "Queue ID %u for RSS is not
configured",
+ rss->queue[i]);
+ return -EINVAL;
+ }
if (!bp->rx_queues[rss->queue[i]]->vnic->rx_queue_cnt &&
!bp->rx_queues[rss->queue[i]]->rx_started)
return -EINVAL;
diff --git a/drivers/net/bnxt/bnxt_hwrm.c b/drivers/net/bnxt/bnxt_hwrm.c
index 1615b36aae..8d2253160f 100644
--- a/drivers/net/bnxt/bnxt_hwrm.c
+++ b/drivers/net/bnxt/bnxt_hwrm.c
@@ -6770,10 +6770,18 @@ static void bnxt_init_ctx_initializer(struct
bnxt_ctx_mem *ctxm,
{
ctxm->init_value = init_val;
ctxm->init_offset = BNXT_CTX_INIT_INVALID_OFFSET;
- if (init_mask_set)
- ctxm->init_offset = init_offset * 4;
- else
+ if (init_mask_set) {
+ ctxm->init_offset = (uint16_t)(init_offset * 4);
+ if (ctxm->init_offset >= ctxm->entry_size) {
+ PMD_DRV_LOG_LINE(WARNING,
+ "ctx type 0x%x: init_offset %u >=
entry_size %u, disabling init",
+ ctxm->type, ctxm->init_offset,
ctxm->entry_size);
+ ctxm->init_value = 0;
+ ctxm->init_offset = BNXT_CTX_INIT_INVALID_OFFSET;
+ }
+ } else {
ctxm->init_value = 0;
+ }
}
static int bnxt_alloc_all_ctx_pg_info(struct bnxt *bp)
--
2.47.3
