Received-SPF: pass (google.com: domain of linux-kernel+bounces-58018-linux.lists.archive=gmail.com@vger.kernel.org designates 2604:1380:4601:e00::3 as permitted sender) client-ip=2604:1380:4601:e00::3;
From: "Romanowski, Rafal" <rafal.romanowski@intel.com>
To: Simon Horman <horms@kernel.org>, ivecera <ivecera@redhat.com>
CC: Mateusz Palczewski <mateusz.palczewski@intel.com>,
	"netdev@vger.kernel.org" <netdev@vger.kernel.org>, "Williams, Mitch A"
	<mitch.a.williams@intel.com>, "Brandeburg, Jesse"
	<jesse.brandeburg@intel.com>, open list <linux-kernel@vger.kernel.org>, "Eric
 Dumazet" <edumazet@google.com>, "Nguyen, Anthony L"
	<anthony.l.nguyen@intel.com>, Jeff Kirsher <jeffrey.t.kirsher@intel.com>,
	Sylwester Dziedziuch <sylwesterx.dziedziuch@intel.com>, Jakub Kicinski
	<kuba@kernel.org>, Paolo Abeni <pabeni@redhat.com>, "David S. Miller"
	<davem@davemloft.net>, "moderated list:INTEL ETHERNET DRIVERS"
	<intel-wired-lan@lists.osuosl.org>
Subject: RE: [Intel-wired-lan] [PATCH net] i40e: Do not allow untrusted VF to
 remove administratively set MAC
Thread-Topic: [Intel-wired-lan] [PATCH net] i40e: Do not allow untrusted VF to
 remove administratively set MAC
Thread-Index: AQHaVEf5VS5h9VRQmkOA7cxvQbQI87D3AioAgAlhHVA=
Date: Thu, 8 Feb 2024 11:57:15 +0000
Message-ID: <SJ0PR11MB58652DF7738CBACACC7B8D9F8F442@SJ0PR11MB5865.namprd11.prod.outlook.com>
References: <20240131131714.23497-1-ivecera@redhat.com>
 <20240202124304.GQ530335@kernel.org>
In-Reply-To: <20240202124304.GQ530335@kernel.org>
Accept-Language: en-US
Content-Language: en-US
x-ms-exchange-antispam-messagedata-chunkcount: 1
x-ms-exchange-antispam-messagedata-0: =?us-ascii?Q?0kmgaF/FtEcyOqtemW8o+BAmwMsIVYLvhQB/2YaVTvCg69t+B8yETEDiRt5h?=
 =?us-ascii?Q?nJ2njb+FvG9Sf9WdI9KIYTyzp1Iem3akxVU8DOwWbI/7BV+KkK9Sa1aalz8u?=
 =?us-ascii?Q?5eGHNzs/WB6n6JSJSTo3IWb37zQnNAbi03yfrx7LDNLS/Dh+tchtpabPyr6l?=
 =?us-ascii?Q?4a9d5n8jcTzuCiJqh0D87WLUtGZWedRfj+Rg4DG79VJfH8+WlzbghxclW1JQ?=
 =?us-ascii?Q?wq1zocnsrrgGhy1GoKO3d0Uxf6JlKG4SPDjnyGJ2TDeFnZ+ZQF6ATT4UPqUX?=
 =?us-ascii?Q?feqCD81f8Ikwvkk6kxAQVwHTJBO7TvyFiTX1EVjeLtp8NZ6A6G7wxUulqQ2W?=
 =?us-ascii?Q?C462nmnoBjLcZruSVHu/tydawT4PpdqS7J0V8fkE7pitd+fhgX3N1DMfBkQj?=
 =?us-ascii?Q?+2mI3Ppn4bxV+2FByGQIDYgnmiUtI7xw3Qf80jIml+PucE7P6nmVpFBZpYFW?=
 =?us-ascii?Q?trKJKMxCQs9PZeWlK1SjlAroQ5NIAdC00TP7QBStkiuwtCReU/rUbUUZlTOY?=
 =?us-ascii?Q?Wr3N/3hZ8wZLmdDl3OzAHtxrgyMWXd+nBJloJXVm+IRHS9pc2dUd1Wo5Y2i1?=
 =?us-ascii?Q?f5zGE/8UIo8+h72hJrwgmO7jQ0Tx+m7fLCbkllMtMaRf8AoYdtQ89Gso6gBO?=
 =?us-ascii?Q?2WUwPSihz8203dPcw6evtYh+pLWx5oRJqVi5Jxwd/tjSiUtW0/ilJYy1ESf7?=
 =?us-ascii?Q?rWQEhGtmcA45rlJZ3yc/tAE3h1iT4BEuMg88pfwZaoasbYFBm/3fL+0V4bVz?=
 =?us-ascii?Q?sxLabI7eOrFZzrc1P7vIq7LZmbiLP8tNbvJZ0tJ6Af8/zKSvJaqQ5fxzmhZs?=
 =?us-ascii?Q?vKJ+Aalws1qpb64SyFdfTDDZGEsDCs3Qu2nrbjUxckj57IpN1xXGho+4vpva?=
 =?us-ascii?Q?xIrapOluy5Xczq3YJlz1QYYPU/T9WxFP2F+T1U2RkQDqNM5//ZxXh2YkkLHG?=
 =?us-ascii?Q?1ux1gtrlFXCtt2ZB9uYteAhMAKkTucjbUtf7++blZ/ZX6MDkmWR0FgB8Iqw+?=
 =?us-ascii?Q?hFXMMSiErYrdiZJxR0Jj7o32TittX2tgKSrMj6ywcreUam4/EoE5RxZ1tcfm?=
 =?us-ascii?Q?ru1C3AyyymM6pMOu4vX/bc3+TNRK/APLEvZFe3aumwPLPgoniaA6f1cxeIir?=
 =?us-ascii?Q?GBwG58n63Neih4i4d95nOE953mxDQO2IeaYjP5OvW7gAv+kz+au1BBfcPMZG?=
 =?us-ascii?Q?fXQeGVbRcl5EMEVAQV7ogF2shEL6z6nE/gx6ojA9l8jSdaLwZE6E7pldVkmD?=
 =?us-ascii?Q?mQHZFjVRYyghN9buiFNglC6/m5iI4+bwAm36rMIauXMuCZeZpibZhaMaCPDN?=
 =?us-ascii?Q?wrBFFfvxMEtkG3KCl+DzFYGM0+CfPgeurFT9k6W/fxhiFVZ2zA860xiqLbV9?=
 =?us-ascii?Q?C62h9H4pFiB/EhWCIhbjts+EMTwfmUA6V3dENEKzcDy5qzR1mY/MvKy0st6f?=
 =?us-ascii?Q?XJZN5LkzBPvyXn5i1XcjLGn65bljWsl0Ct+q7jFip8MK8JGDh6WEAaouUigM?=
 =?us-ascii?Q?e8TZkztBW7vk9s6yeX0+qJx27Q3/me9Gkr/Q/73xjUziotUZNdK6zY2Lgdea?=
 =?us-ascii?Q?0fXhJ68T4N/gisVBY69T9m2B0DKT3o95yCZlMoHC?=
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: quoted-printable
Precedence: bulk
X-Mailing-List: linux-kernel@vger.kernel.org
List-Id: <linux-kernel.vger.kernel.org>
List-Subscribe: <mailto:linux-kernel+subscribe@vger.kernel.org>
List-Unsubscribe: <mailto:linux-kernel+unsubscribe@vger.kernel.org>
MIME-Version: 1.0
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-AuthSource: SJ0PR11MB5865.namprd11.prod.outlook.com
X-MS-Exchange-CrossTenant-Network-Message-Id: ed1b79b7-60bf-40cf-15d7-08dc289d1817
X-MS-Exchange-CrossTenant-originalarrivaltime: 08 Feb 2024 11:57:15.8868
 (UTC)
X-MS-Exchange-CrossTenant-fromentityheader: Hosted
X-MS-Exchange-CrossTenant-id: 46c98d88-e344-4ed4-8496-4ed7712e255d
X-MS-Exchange-CrossTenant-mailboxtype: HOSTED
X-MS-Exchange-CrossTenant-userprincipalname: /G767KZHday7/dfXATCQ7IkeB+3hleX7Oh4FF17ekIsOPrScwKNuFjz1KEK+Ss8Q+drG8OTMoU7POGwl8t7zytl5lEhC+MtLeMlVIPOuudU=
X-MS-Exchange-Transport-CrossTenantHeadersStamped: SJ2PR11MB8565
X-OriginatorOrg: intel.com

> -----Original Message-----
> From: Intel-wired-lan <intel-wired-lan-bounces@osuosl.org> On Behalf Of
> Simon Horman
> Sent: Friday, February 2, 2024 1:43 PM
> To: ivecera <ivecera@redhat.com>
> Cc: Mateusz Palczewski <mateusz.palczewski@intel.com>;
> netdev@vger.kernel.org; Williams, Mitch A <mitch.a.williams@intel.com>;
> Brandeburg, Jesse <jesse.brandeburg@intel.com>; open list <linux-
> kernel@vger.kernel.org>; Eric Dumazet <edumazet@google.com>; Nguyen,
> Anthony L <anthony.l.nguyen@intel.com>; Jeff Kirsher
> <jeffrey.t.kirsher@intel.com>; Sylwester Dziedziuch
> <sylwesterx.dziedziuch@intel.com>; Jakub Kicinski <kuba@kernel.org>; Paol=
o
> Abeni <pabeni@redhat.com>; David S. Miller <davem@davemloft.net>;
> moderated list:INTEL ETHERNET DRIVERS <intel-wired-lan@lists.osuosl.org>
> Subject: Re: [Intel-wired-lan] [PATCH net] i40e: Do not allow untrusted V=
F to
> remove administratively set MAC
>=20
> On Wed, Jan 31, 2024 at 02:17:14PM +0100, Ivan Vecera wrote:
> > Currently when PF administratively sets VF's MAC address and the VF is
> > put down (VF tries to delete all MACs) then the MAC is removed from
> > MAC filters and primary VF MAC is zeroed.
> >
> > Do not allow untrusted VF to remove primary MAC when it was set
> > administratively by PF.
> >
> > Reproducer:
> > 1) Create VF
> > 2) Set VF interface up
> > 3) Administratively set the VF's MAC
> > 4) Put VF interface down
> >
> > [root@host ~]# echo 1 > /sys/class/net/enp2s0f0/device/sriov_numvfs
> > [root@host ~]# ip link set enp2s0f0v0 up [root@host ~]# ip link set
> > enp2s0f0 vf 0 mac fe:6c:b5:da:c7:7d [root@host ~]# ip link show
> > enp2s0f0
> > 23: enp2s0f0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc
> mq state UP mode DEFAULT group default qlen 1000
> >     link/ether 3c:ec:ef:b7:dd:04 brd ff:ff:ff:ff:ff:ff
> >     vf 0     link/ether fe:6c:b5:da:c7:7d brd ff:ff:ff:ff:ff:ff, spoof =
checking on,
> link-state auto, trust off
> > [root@host ~]# ip link set enp2s0f0v0 down [root@host ~]# ip link show
> > enp2s0f0
> > 23: enp2s0f0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc
> mq state UP mode DEFAULT group default qlen 1000
> >     link/ether 3c:ec:ef:b7:dd:04 brd ff:ff:ff:ff:ff:ff
> >     vf 0     link/ether 00:00:00:00:00:00 brd ff:ff:ff:ff:ff:ff, spoof =
checking on,
> link-state auto, trust off
> >
> > Fixes: 700bbf6c1f9e ("i40e: allow VF to remove any MAC filter")
> > Fixes: ceb29474bbbc ("i40e: Add support for VF to specify its primary
> > MAC address")
> > Signed-off-by: Ivan Vecera <ivecera@redhat.com>
>=20
> Thanks Ivan,
>=20
> Reviewed-by: Simon Horman <horms@kernel.org>


Tested-by: Rafal Romanowski <rafal.romanowski@intel.com>