From: Dakota Sicher <[email protected]> ulp_rte_parser_fld_copy() and ulp_rte_prsr_fld_mask() copy a caller-supplied size into fixed 16-byte spec and mask arrays without checking it. All current callers pass sizeof() of a protocol field, but nothing enforces that. Clamp the size to the field storage and log an error.
Signed-off-by: Dakota Sicher <[email protected]> Signed-off-by: Manish Kurup <[email protected]> Signed-off-by: Mohammad Shuab Siddique <[email protected]> --- drivers/net/bnxt/tf_ulp/ulp_rte_parser.c | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/drivers/net/bnxt/tf_ulp/ulp_rte_parser.c b/drivers/net/bnxt/tf_ulp/ulp_rte_parser.c index fb1dc3f60a8..b68d86fe5ba 100644 --- a/drivers/net/bnxt/tf_ulp/ulp_rte_parser.c +++ b/drivers/net/bnxt/tf_ulp/ulp_rte_parser.c @@ -66,6 +66,11 @@ ulp_rte_parser_fld_copy(struct ulp_rte_hdr_field *field, const void *buffer, uint32_t size) { + if (unlikely(size > RTE_PARSER_FLOW_HDR_FIELD_SIZE)) { + BNXT_DRV_DBG(ERR, "Field size %u exceeds max of %u, clamping", + size, RTE_PARSER_FLOW_HDR_FIELD_SIZE); + size = RTE_PARSER_FLOW_HDR_FIELD_SIZE; + } field->size = size; memcpy(field->spec, buffer, field->size); field++; @@ -106,6 +111,11 @@ ulp_rte_prsr_fld_mask(struct ulp_rte_parser_params *params, { struct ulp_rte_hdr_field *field = ¶ms->hdr_field[*idx]; + if (unlikely(size > RTE_PARSER_FLOW_HDR_FIELD_SIZE)) { + BNXT_DRV_DBG(ERR, "Field size %u exceeds max of %u, clamping", + size, RTE_PARSER_FLOW_HDR_FIELD_SIZE); + size = RTE_PARSER_FLOW_HDR_FIELD_SIZE; + } /* update the field size */ field->size = size; -- 2.47.3
