2023-11-24 21:12:00

by Elena Salomatkina

[permalink] [raw]
Subject: [PATCH net] octeontx2-af: Fix possible buffer overflow

A loop in rvu_mbox_handler_nix_bandprof_free() contains
a break if (idx == MAX_BANDPROF_PER_PFFUNC),
but if idx may reach MAX_BANDPROF_PER_PFFUNC
buffer '(*req->prof_idx)[layer]' overflow happens before that check.

The patch moves the break to the
beginning of the loop.

Found by Linux Verification Center (linuxtesting.org) with SVACE.

Fixes: e8e095b3b370 ("octeontx2-af: cn10k: Bandwidth profiles config support").
Signed-off-by: Elena Salomatkina <[email protected]>
Reviewed-by: Simon Horman <[email protected]>
---
drivers/net/ethernet/marvell/octeontx2/af/rvu_nix.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/net/ethernet/marvell/octeontx2/af/rvu_nix.c b/drivers/net/ethernet/marvell/octeontx2/af/rvu_nix.c
index 23c2f2ed2fb8..c112c71ff576 100644
--- a/drivers/net/ethernet/marvell/octeontx2/af/rvu_nix.c
+++ b/drivers/net/ethernet/marvell/octeontx2/af/rvu_nix.c
@@ -5505,6 +5505,8 @@ int rvu_mbox_handler_nix_bandprof_free(struct rvu *rvu,

ipolicer = &nix_hw->ipolicer[layer];
for (idx = 0; idx < req->prof_count[layer]; idx++) {
+ if (idx == MAX_BANDPROF_PER_PFFUNC)
+ break;
prof_idx = req->prof_idx[layer][idx];
if (prof_idx >= ipolicer->band_prof.max ||
ipolicer->pfvf_map[prof_idx] != pcifunc)
@@ -5518,8 +5520,6 @@ int rvu_mbox_handler_nix_bandprof_free(struct rvu *rvu,
ipolicer->pfvf_map[prof_idx] = 0x00;
ipolicer->match_id[prof_idx] = 0;
rvu_free_rsrc(&ipolicer->band_prof, prof_idx);
- if (idx == MAX_BANDPROF_PER_PFFUNC)
- break;
}
}
mutex_unlock(&rvu->rsrc_lock);
--
2.34.1


2023-11-28 02:31:44

by Jakub Kicinski

[permalink] [raw]
Subject: Re: [PATCH net] octeontx2-af: Fix possible buffer overflow

On Sat, 25 Nov 2023 00:08:02 +0300 Elena Salomatkina wrote:
> A loop in rvu_mbox_handler_nix_bandprof_free() contains
> a break if (idx == MAX_BANDPROF_PER_PFFUNC),
> but if idx may reach MAX_BANDPROF_PER_PFFUNC
> buffer '(*req->prof_idx)[layer]' overflow happens before that check.
>
> The patch moves the break to the
> beginning of the loop.
>
> Found by Linux Verification Center (linuxtesting.org) with SVACE.
>
> Fixes: e8e095b3b370 ("octeontx2-af: cn10k: Bandwidth profiles config support").
> Signed-off-by: Elena Salomatkina <[email protected]>
> Reviewed-by: Simon Horman <[email protected]>

Marvell folks, at least one of you has to review this. Please see:
https://docs.kernel.org/next/maintainer/feature-and-driver-maintainers.html

2023-11-28 03:16:59

by Subbaraya Sundeep Bhatta

[permalink] [raw]
Subject: RE: [EXT] [PATCH net] octeontx2-af: Fix possible buffer overflow

Hi,

>-----Original Message-----
>From: Elena Salomatkina <[email protected]>
>Sent: Saturday, November 25, 2023 2:38 AM
>To: Sunil Kovvuri Goutham <[email protected]>
>Cc: Elena Salomatkina <[email protected]>; Linu Cherian
><[email protected]>; Geethasowjanya Akula <[email protected]>;
>Jerin Jacob Kollanukkaran <[email protected]>; Hariprasad Kelam
><[email protected]>; Subbaraya Sundeep Bhatta <[email protected]>;
>David S. Miller <[email protected]>; Eric Dumazet
><[email protected]>; Jakub Kicinski <[email protected]>; Paolo Abeni
><[email protected]>; [email protected]; linux-
>[email protected]; [email protected]; Simon Horman
><[email protected]>
>Subject: [EXT] [PATCH net] octeontx2-af: Fix possible buffer overflow
>
>----------------------------------------------------------------------
>A loop in rvu_mbox_handler_nix_bandprof_free() contains a break if (idx ==
>MAX_BANDPROF_PER_PFFUNC), but if idx may reach
>MAX_BANDPROF_PER_PFFUNC buffer '(*req->prof_idx)[layer]' overflow
>happens before that check.
>
>The patch moves the break to the
>beginning of the loop.
>
>Found by Linux Verification Center (linuxtesting.org) with SVACE.
>
>Fixes: e8e095b3b370 ("octeontx2-af: cn10k: Bandwidth profiles config
>support").
>Signed-off-by: Elena Salomatkina <[email protected]>
>Reviewed-by: Simon Horman <[email protected]>

Reviewed-by: Subbaraya Sundeep <[email protected]>

Thanks,
Sundeep

>---
> drivers/net/ethernet/marvell/octeontx2/af/rvu_nix.c | 4 ++--
> 1 file changed, 2 insertions(+), 2 deletions(-)
>
>diff --git a/drivers/net/ethernet/marvell/octeontx2/af/rvu_nix.c
>b/drivers/net/ethernet/marvell/octeontx2/af/rvu_nix.c
>index 23c2f2ed2fb8..c112c71ff576 100644
>--- a/drivers/net/ethernet/marvell/octeontx2/af/rvu_nix.c
>+++ b/drivers/net/ethernet/marvell/octeontx2/af/rvu_nix.c
>@@ -5505,6 +5505,8 @@ int rvu_mbox_handler_nix_bandprof_free(struct
>rvu *rvu,
>
> ipolicer = &nix_hw->ipolicer[layer];
> for (idx = 0; idx < req->prof_count[layer]; idx++) {
>+ if (idx == MAX_BANDPROF_PER_PFFUNC)
>+ break;
> prof_idx = req->prof_idx[layer][idx];
> if (prof_idx >= ipolicer->band_prof.max ||
> ipolicer->pfvf_map[prof_idx] != pcifunc) @@ -
>5518,8 +5520,6 @@ int rvu_mbox_handler_nix_bandprof_free(struct rvu
>*rvu,
> ipolicer->pfvf_map[prof_idx] = 0x00;
> ipolicer->match_id[prof_idx] = 0;
> rvu_free_rsrc(&ipolicer->band_prof, prof_idx);
>- if (idx == MAX_BANDPROF_PER_PFFUNC)
>- break;
> }
> }
> mutex_unlock(&rvu->rsrc_lock);
>--
>2.34.1

2023-11-28 10:01:04

by patchwork-bot+netdevbpf

[permalink] [raw]
Subject: Re: [PATCH net] octeontx2-af: Fix possible buffer overflow

Hello:

This patch was applied to netdev/net.git (main)
by Paolo Abeni <[email protected]>:

On Sat, 25 Nov 2023 00:08:02 +0300 you wrote:
> A loop in rvu_mbox_handler_nix_bandprof_free() contains
> a break if (idx == MAX_BANDPROF_PER_PFFUNC),
> but if idx may reach MAX_BANDPROF_PER_PFFUNC
> buffer '(*req->prof_idx)[layer]' overflow happens before that check.
>
> The patch moves the break to the
> beginning of the loop.
>
> [...]

Here is the summary with links:
- [net] octeontx2-af: Fix possible buffer overflow
https://git.kernel.org/netdev/net/c/ad31c629ca3c

You are awesome, thank you!
--
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html