Re: [PATCH iwl-net v2] ice: fix bound parser hash offset before reading packet data

[Simon Horman <horms@kernel.org>]

On Mon, Aug 24, 2026 at 03:22:48PM +0200, Aleksandr Loktionov wrote:
> ice_rt_ho_set() uses the HO register as the starting offset of an
> ICE_GPR_HV_SIZE-byte memcpy() out of rt->pkt_buf. Potentially HO can
> be advanced by user-controlled data reachable through
> ice_parse_raw_rss_pattern() -> ice_parser_run() ->
> ice_parser_rt_execute() -> ice_rt_gpr_set() -> ice_rt_ho_set(), i.e. a
> VF-supplied raw RSS pattern (virt/rss.c), with no bound against the
> size of pkt_buf.
> 
> Clamp HO to the last offset from which ICE_GPR_HV_SIZE bytes can still
> be read out of pkt_buf, deriving the limit from sizeof(rt->pkt_buf)
> so it stays correct if the packet buffer layout changes.
> 
> ice_parser_rt_pktbuf_set() stores the caller's raw pkt_len in
> rt->pkt_len, even though it only ever copies min(ICE_PARSER_MAX_PKT_LEN,
> pkt_len) bytes into rt->pkt_buf. Both ice_parse_raw_rss_pattern() and
> ice_vc_fdir_parse_raw() pass a VF-supplied pkt_len of up to
> VIRTCHNL_MAX_SIZE_RAW_PACKET (1024), i.e. larger than
> ICE_PARSER_MAX_PKT_LEN (504). With HO now capped at 504, the
> "HO >= pkt_len" loop exit in ice_parser_rt_execute() would never be
> reached for such an oversized pkt_len. Store the already-clamped
> length instead, so rt->pkt_len always matches what was actually copied
> into rt->pkt_buf and the loop-exit check remains a valid bound
> regardless of the caller-supplied pkt_len.
> 
> Fixes: 9a4c07aaa0f5 ("ice: add parser execution main loop")
> Cc: stable@vger.kernel.org
> Cc: horms@kernel.org
> Signed-off-by: Aleksandr Loktionov <aleksandr.loktionov@intel.com>
> ---
> v1 -> v2:
> - also clamp rt->pkt_len in ice_parser_rt_pktbuf_set() to the same
>   ICE_PARSER_MAX_PKT_LEN bound already used for the rt->pkt_buf copy,
>   so the "HO >= pkt_len" loop-exit in ice_parser_rt_execute() can't be
>   bypassed by an oversized pkt_len from the raw RSS/FDIR VF paths
>   (reported in review)
> - dropped Przemek's Reviewed-by since the patch changed

Thanks for the update.

Reviewed-by: Simon Horman <horms@kernel.org>