Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
Message-ID: <e246efa2-7bc1-5413-32d0-c2927ebb001e@yandex-team.ru>
Date:   Wed, 18 Jan 2023 11:29:19 +0300
MIME-Version: 1.0
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:102.0) Gecko/20100101
 Thunderbird/102.2.2
Subject: Re: [PATCH net 1/2] net/ethernet/chelsio: fix cxgb4_getpgtccfg wrong
 memory access
To:     Leon Romanovsky <leon@kernel.org>
Cc:     rajur@chelsio.com, davem@davemloft.net, edumazet@google.com,
        kuba@kernel.org, pabeni@redhat.com, anish@chelsio.com,
        hariprasad@chelsio.com, netdev@vger.kernel.org,
        linux-kernel@vger.kernel.org
References: <20230116152100.30094-1-davydov-max@yandex-team.ru>
 <20230116152100.30094-2-davydov-max@yandex-team.ru> <Y8ZonuQJn8gO9GX5@unreal>
Content-Language: en-US
From:   Maksim Davydov <davydov-max@yandex-team.ru>
In-Reply-To: <Y8ZonuQJn8gO9GX5@unreal>
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: 7bit
Precedence: bulk


On 1/17/23 12:21, Leon Romanovsky wrote:
> On Mon, Jan 16, 2023 at 06:20:59PM +0300, Maksim Davydov wrote:
>> *pgid can be in range 0 to 0xF (bitmask 0xF) but valid values for PGID
>> are between 0 and 7. Also the size of pgrate is 8. Thus, we are needed
>> additional check to make sure that this code doesn't have access to tsa.
>>
>> Found by Linux Verification Center (linuxtesting.org) with the SVACE
>> static analysis tool.
>>
>> Fixes: 76bcb31efc06 ("cxgb4 : Add DCBx support codebase and dcbnl_ops")
>> Signed-off-by: Maksim Davydov <davydov-max@yandex-team.ru>
>> ---
>>   drivers/net/ethernet/chelsio/cxgb4/cxgb4_dcb.c | 5 ++++-
>>   1 file changed, 4 insertions(+), 1 deletion(-)
>>
>> diff --git a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_dcb.c b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_dcb.c
>> index 7d5204834ee2..3aa65f0f335e 100644
>> --- a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_dcb.c
>> +++ b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_dcb.c
>> @@ -471,7 +471,10 @@ static void cxgb4_getpgtccfg(struct net_device *dev, int tc,
>>   		return;
>>   	}
>>   
>> -	*bw_per = pcmd.u.dcb.pgrate.pgrate[*pgid];
>> +	/* Valid values are: 0-7 */
> How do you see it?
>
> There are lines below that assume something different.
>     477         /* prio_type is link strict */
>     478         if (*pgid != 0xF)
>     479                 *prio_type = 0x2;
>
But if *pgid == 0xF we get value for *bw_per from pgrate.tsa, it seems 
not correct

Thanks for reviewing,
Maksim Davydov
>> +	if (*pgid <= 7)
>> +		*bw_per = pcmd.u.dcb.pgrate.pgrate[*pgid];
> Why do you think that it is valid simply do not set *bw_per?
>
> Thanks