From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from smtp4.osuosl.org (smtp4.osuosl.org [140.211.166.137]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id CC868C282D2 for ; Fri, 28 Feb 2025 17:26:00 +0000 (UTC) Received: from localhost (localhost [127.0.0.1]) by smtp4.osuosl.org (Postfix) with ESMTP id 8CD1B4F4F5; Fri, 28 Feb 2025 17:26:00 +0000 (UTC) X-Virus-Scanned: amavis at osuosl.org Received: from smtp4.osuosl.org ([127.0.0.1]) by localhost (smtp4.osuosl.org [127.0.0.1]) (amavis, port 10024) with ESMTP id 7BwN2aie_F4f; Fri, 28 Feb 2025 17:25:59 +0000 (UTC) X-Comment: SPF check N/A for local connections - client-ip=140.211.166.142; helo=lists1.osuosl.org; envelope-from=intel-wired-lan-bounces@osuosl.org; receiver= DKIM-Filter: OpenDKIM Filter v2.11.0 smtp4.osuosl.org AF237509F8 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=osuosl.org; s=default; t=1740763559; bh=lw0JWqI1OPnu2Yb7FT9723b2AYvYz4/NhY06TvPuIqs=; h=Date:From:To:Cc:References:In-Reply-To:Subject:List-Id: List-Unsubscribe:List-Archive:List-Post:List-Help:List-Subscribe: From; b=HAzUgs2D2VZUTgxKdtW0G+QoiWrWdzz6jJ8ERAIfB51P9VhDbjXFX+vAYRv7amwZX rb/hW7iLP2T36WO+RU6e6bcCOGsbtYp0SIO0KCWokYe9LhxrR5bgNtywfhzduzUPHS wayEIm0/qVylYfZxf2d7kGzmW4f9z0fljci5YACgc+lpkfKVL7Sh74lOAyZO4nPBjv UOSj5or/mUFTgfr9ia+6+sZdX35IcsK+7UuPM8KTwqdRWII/uwMDOosjAJ9ECPcP24 Rq+fFIUx7Ag/Wa76v7/IW6qQawv87zp0voQ9Zyx0dSlzBzTt8CcAjf4C8x15maxUk4 hXgKQHsdLDRIw== Received: from lists1.osuosl.org (lists1.osuosl.org [140.211.166.142]) by smtp4.osuosl.org (Postfix) with ESMTP id AF237509F8; Fri, 28 Feb 2025 17:25:59 +0000 (UTC) Received: from smtp4.osuosl.org (smtp4.osuosl.org [IPv6:2605:bc80:3010::137]) by lists1.osuosl.org (Postfix) with ESMTP id 04C3B1CB for ; Fri, 28 Feb 2025 17:20:27 +0000 (UTC) Received: from localhost (localhost [127.0.0.1]) by smtp4.osuosl.org (Postfix) with ESMTP id D01E04EF68 for ; Fri, 28 Feb 2025 17:09:45 +0000 (UTC) X-Virus-Scanned: amavis at osuosl.org Received: from smtp4.osuosl.org ([127.0.0.1]) by localhost (smtp4.osuosl.org [127.0.0.1]) (amavis, port 10024) with ESMTP id XtXMNwrdKeps for ; Fri, 28 Feb 2025 17:09:45 +0000 (UTC) Received-SPF: Pass (mailfrom) identity=mailfrom; client-ip=172.105.4.254; helo=tor.source.kernel.org; envelope-from=horms@kernel.org; receiver= DMARC-Filter: OpenDMARC Filter v1.4.2 smtp4.osuosl.org EFA354F081 DKIM-Filter: OpenDKIM Filter v2.11.0 smtp4.osuosl.org EFA354F081 Received: from tor.source.kernel.org (tor.source.kernel.org [172.105.4.254]) by smtp4.osuosl.org (Postfix) with ESMTPS id EFA354F081 for ; Fri, 28 Feb 2025 17:09:44 +0000 (UTC) Received: from smtp.kernel.org (transwarp.subspace.kernel.org [100.75.92.58]) by tor.source.kernel.org (Postfix) with ESMTP id D3CFE61FAB; Fri, 28 Feb 2025 17:09:34 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 235BEC4CED6; Fri, 28 Feb 2025 17:09:41 +0000 (UTC) Date: Fri, 28 Feb 2025 17:09:39 +0000 From: Simon Horman To: Martyna Szapar-Mudlaw Cc: intel-wired-lan@lists.osuosl.org, netdev@vger.kernel.org, Mateusz Polchlopek Message-ID: <20250228170939.GK1615191@kernel.org> References: <20250225090847.513849-2-martyna.szapar-mudlaw@linux.intel.com> <20250225090847.513849-8-martyna.szapar-mudlaw@linux.intel.com> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <20250225090847.513849-8-martyna.szapar-mudlaw@linux.intel.com> X-Mailman-Original-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1740762583; bh=S9zzy7A7bNCFlFQ9EkUF9Yue0Nn9SL09FASYNBH3ceg=; h=Date:From:To:Cc:Subject:References:In-Reply-To:From; b=n4hukd2VmiE1dayEMU6q9Ah/OuSfy21KtM0dx1l1XCYTS32ikeHNUa1xLtPl1c7Nb 5ULoNmMkI4OJfdtX5vUIO2U8LGLyLWkAbtjwu2ZZKZLaRp5h0I5oKnC3rbuzj1Ri7v iPKF4hutb2V8H+ajOGPmKOst69/Ikc2K+5Xel7ijQLUI7oH6XtB0wK6z39HQBhzQR5 JHmFVCuep1eMSkQcLu3DjrOphWUyJDKWCKIk/U0+gA45TBuycy2cgKTmdGVmv52SEM ebbOKwl5K8/BTQRV9SJiBVo6DEty66EEa5vrZ/QtwOBvEumqz7XaE5m/giHTU6xmOz BE5N6GjAyRNzw== X-Mailman-Original-Authentication-Results: smtp4.osuosl.org; dmarc=pass (p=quarantine dis=none) header.from=kernel.org X-Mailman-Original-Authentication-Results: smtp4.osuosl.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.a=rsa-sha256 header.s=k20201202 header.b=n4hukd2V Subject: Re: [Intel-wired-lan] [iwl-net v2 5/5] ice: fix using untrusted value of pkt_len in ice_vc_fdir_parse_raw() X-BeenThere: intel-wired-lan@osuosl.org X-Mailman-Version: 2.1.30 Precedence: list List-Id: Intel Wired Ethernet Linux Kernel Driver Development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: intel-wired-lan-bounces@osuosl.org Sender: "Intel-wired-lan" On Tue, Feb 25, 2025 at 10:08:49AM +0100, Martyna Szapar-Mudlaw wrote: > From: Mateusz Polchlopek > > Fix using the untrusted value of proto->raw.pkt_len in function > ice_vc_fdir_parse_raw() by verifying if it does not exceed the > VIRTCHNL_MAX_SIZE_RAW_PACKET value. > > Fixes: 99f419df8a5c ("ice: enable FDIR filters from raw binary patterns for VFs") > Signed-off-by: Mateusz Polchlopek > Signed-off-by: Martyna Szapar-Mudlaw > --- > .../ethernet/intel/ice/ice_virtchnl_fdir.c | 25 +++++++++++++------ > 1 file changed, 17 insertions(+), 8 deletions(-) > > diff --git a/drivers/net/ethernet/intel/ice/ice_virtchnl_fdir.c b/drivers/net/ethernet/intel/ice/ice_virtchnl_fdir.c > index 14e3f0f89c78..6250629ee8f9 100644 > --- a/drivers/net/ethernet/intel/ice/ice_virtchnl_fdir.c > +++ b/drivers/net/ethernet/intel/ice/ice_virtchnl_fdir.c > @@ -835,18 +835,27 @@ ice_vc_fdir_parse_raw(struct ice_vf *vf, > u8 *pkt_buf, *msk_buf __free(kfree); > struct ice_parser_result rslt; > struct ice_pf *pf = vf->pf; > + u16 pkt_len, udp_port = 0; > struct ice_parser *psr; > int status = -ENOMEM; > struct ice_hw *hw; > - u16 udp_port = 0; > > - pkt_buf = kzalloc(proto->raw.pkt_len, GFP_KERNEL); > - msk_buf = kzalloc(proto->raw.pkt_len, GFP_KERNEL); > + if (!proto->raw.pkt_len) > + return -EINVAL; > + > + pkt_len = proto->raw.pkt_len; Hi Martyna, A check is made for !proto->raw.pkt_len above. And a check is made for !pkt_len below. This seems redundant. > + > + if (!pkt_len || pkt_len > VIRTCHNL_MAX_SIZE_RAW_PACKET) > + return -EINVAL; ...