From mboxrd@z Thu Jan 1 00:00:00 1970 From: Rasesh Mody Subject: [PATCH 6/8] net/qede/base: fix Rx queue access by malicious VFs Date: Fri, 2 Dec 2016 22:35:07 -0800 Message-ID: <1480746909-25686-6-git-send-email-Rasesh.Mody@cavium.com> References: <1480746909-25686-1-git-send-email-Rasesh.Mody@cavium.com> Mime-Version: 1.0 Content-Type: text/plain Cc: , Rasesh Mody To: Return-path: Received: from mx0b-0016ce01.pphosted.com (0016ce01.pphosted.com [67.231.156.153]) by dpdk.org (Postfix) with ESMTP id D3A6C68A5 for ; Sat, 3 Dec 2016 07:35:29 +0100 (CET) In-Reply-To: <1480746909-25686-1-git-send-email-Rasesh.Mody@cavium.com> List-Id: DPDK patches and discussions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: dev-bounces@dpdk.org Sender: "dev" 8.10.x.x was supposed to prevent malicious VFs from using out-of-bound queue indices, but apparently Rx queue access is still done prior to the index being validated by PF. Fixes: 98bc693e ("net/qede/base: change queue start") Signed-off-by: Rasesh Mody --- drivers/net/qede/base/ecore_sriov.c | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) diff --git a/drivers/net/qede/base/ecore_sriov.c b/drivers/net/qede/base/ecore_sriov.c index de54b9a0..12552966 100644 --- a/drivers/net/qede/base/ecore_sriov.c +++ b/drivers/net/qede/base/ecore_sriov.c @@ -1968,6 +1968,11 @@ static void ecore_iov_vf_mbx_start_rxq(struct ecore_hwfn *p_hwfn, enum _ecore_status_t rc; req = &mbx->req_virt->start_rxq; + + if (!ecore_iov_validate_rxq(p_hwfn, vf, req->rx_qid) || + !ecore_iov_validate_sb(p_hwfn, vf, req->hw_sb)) + goto out; + OSAL_MEMSET(&p_params, 0, sizeof(p_params)); p_params.queue_id = (u8)vf->vf_queues[req->rx_qid].fw_rx_qid; p_params.vf_qid = req->rx_qid; @@ -1976,10 +1981,6 @@ static void ecore_iov_vf_mbx_start_rxq(struct ecore_hwfn *p_hwfn, p_params.sb = req->hw_sb; p_params.sb_idx = req->sb_index; - if (!ecore_iov_validate_rxq(p_hwfn, vf, req->rx_qid) || - !ecore_iov_validate_sb(p_hwfn, vf, req->hw_sb)) - goto out; - /* Legacy VFs have their Producers in a different location, which they * calculate on their own and clean the producer prior to this. */ -- 2.11.0.rc1