From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mgamail.intel.com (mgamail.intel.com [192.198.163.8]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 370FD3EFFC6; Mon, 6 Jul 2026 13:14:06 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=192.198.163.8 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1783343649; cv=none; b=RwvxwR7WKLYTs4vx0V49HpRmEoh9An1U/rHErujHmTmLfZpD6bEleKV2dAl0gV/TwjrfUu/CmEKm7l7oW7hvJqLOEa1Ck5uAiga1q/DRzg6REH2059pDMVxoPES5BUYF+gjPwGNnlGm1zQMqenbO4FCRW56jrv1hA5kIwE5KH4c= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1783343649; c=relaxed/simple; bh=/gzse8Hbg6PtoujjX4AgsuIwqG3oGT1yLJT6Vw3slKo=; h=Message-ID:Date:MIME-Version:Subject:To:Cc:References:From: In-Reply-To:Content-Type; b=MrnC+HOWuqopjLlnAePqVdtVrpe2SrUmsJ8PQJyYru2uTw9u+4q36Qpw7y/A00a1OlVa5kPt7p82w775Luyhue5BASNicY9iiuy6Twr8l7Pk2Xg2MZdjucGlXudBOVyB936wi0ZUo8fHUlvkzRJc2UIaxFFj/OIgUxOQcx+gSak= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.intel.com; spf=pass smtp.mailfrom=linux.intel.com; dkim=pass (2048-bit key) header.d=intel.com header.i=@intel.com header.b=KXM+DUnL; arc=none smtp.client-ip=192.198.163.8 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.intel.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linux.intel.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=intel.com header.i=@intel.com header.b="KXM+DUnL" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=intel.com; i=@intel.com; q=dns/txt; s=Intel; t=1783343647; x=1814879647; h=message-id:date:mime-version:subject:to:cc:references: from:in-reply-to:content-transfer-encoding; bh=/gzse8Hbg6PtoujjX4AgsuIwqG3oGT1yLJT6Vw3slKo=; b=KXM+DUnL4MWuXk55ExkiTexIV8SC5R148UzYA34x6vtz1x7g05sQS3ZT vg7c1h0aySfK2FxPsJN75kgSyzfCKjK0YtdGEJyMaEhTvVZ3U13/PRlX4 hCkJYzWDaXZcbC4PyeBhbqCUynxRx9hi+d8VLfCZuZAv4A2FwlVFmNLlg v1QCTaSGUEwPwIPtwmpF8rcXL/AbTy4cDQH54OOTgNto9z/djnN+Xr4eO znt/aN9T6xUPTtQPKQkOocCProdKlTHQrxnjCjLyvhD42kYq/C712uB/t Bw/IzjH9QceLuB+z8i/J/ON1YilIu8pV8Yrg+wRZityVXX6UAPsnrShzj A==; X-CSE-ConnectionGUID: cfN2VTWGRL6t1FzRO3DvSQ== X-CSE-MsgGUID: cyPHtlpTTG27Eb2BovGHgQ== X-IronPort-AV: E=McAfee;i="6800,10657,11838"; a="101521527" X-IronPort-AV: E=Sophos;i="6.25,149,1779174000"; d="scan'208";a="101521527" Received: from orviesa006.jf.intel.com ([10.64.159.146]) by fmvoesa102.fm.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 06 Jul 2026 06:14:06 -0700 X-CSE-ConnectionGUID: WQzG8MpsTY6n1o1gH5Jpzg== X-CSE-MsgGUID: wJjsyAA6R2qcUYQWgyxI8g== X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="6.25,149,1779174000"; d="scan'208";a="251963225" Received: from linux.intel.com ([10.54.29.200]) by orviesa006.jf.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 06 Jul 2026 06:14:06 -0700 Received: from [10.102.88.191] (soc-5CG4396XFD.clients.intel.com [10.102.88.191]) by linux.intel.com (Postfix) with ESMTP id 8E28720C5DC7; Mon, 6 Jul 2026 06:14:03 -0700 (PDT) Message-ID: <80a56d5b-da01-4ece-a7f4-56b357e654a7@linux.intel.com> Date: Mon, 6 Jul 2026 15:14:02 +0200 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 User-Agent: Mozilla Thunderbird Subject: Re: [Intel-wired-lan] [PATCH] ixgbe: validate E610 PFA TLV bounds To: Marcin Szycik , Pengpeng Hou , Tony Nguyen Cc: Przemek Kitszel , Andrew Lunn , "David S. Miller" , Eric Dumazet , Jakub Kicinski , Paolo Abeni , intel-wired-lan@lists.osuosl.org, netdev@vger.kernel.org, linux-kernel@vger.kernel.org References: <20260706092500.79044-1-pengpeng@iscas.ac.cn> <9750092f-264e-45a1-af11-2f574ab67fa4@linux.intel.com> Content-Language: pl From: Tomasz Lichwala In-Reply-To: <9750092f-264e-45a1-af11-2f574ab67fa4@linux.intel.com> Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit W dniu 6.07.2026 o 12:02, Marcin Szycik pisze: > > > On 06/07/2026 11:25, Pengpeng Hou wrote: >> ixgbe_get_pfa_module_tlv() walks E610 PFA TLV records stored in >> EEPROM. >> >> Stop parsing malformed TLVs whose header or declared value length would >> exceed the PFA boundary. >> >> Signed-off-by: Pengpeng Hou >> --- >> drivers/net/ethernet/intel/ixgbe/ixgbe_e610.c | 6 ++++++ >> 1 file changed, 6 insertions(+) >> >> diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_e610.c b/drivers/net/ethernet/intel/ixgbe/ixgbe_e610.c >> index 4d8ae5b56145..03e88bdf5a43 100644 >> --- a/drivers/net/ethernet/intel/ixgbe/ixgbe_e610.c >> +++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_e610.c >> @@ -3895,6 +3895,9 @@ static int ixgbe_get_pfa_module_tlv(struct ixgbe_hw *hw, u16 *module_tlv, >> while (next_tlv < pfa_end_ptr) { >> u16 tlv_sub_module_type, tlv_len; >> >> + if (pfa_end_ptr - next_tlv < 2) >> + break; > > This check could go in the while condition above. > >> + >> /* Read TLV type */ >> err = ixgbe_read_ee_aci_e610(hw, next_tlv, >> &tlv_sub_module_type); >> @@ -3917,6 +3920,9 @@ static int ixgbe_get_pfa_module_tlv(struct ixgbe_hw *hw, u16 *module_tlv, >> /* Check next TLV, i.e. current TLV pointer + length + 2 words >> * (for current TLV's type and length). >> */ >> + if (tlv_len > pfa_end_ptr - next_tlv - 2) >> + break; >> + >> next_tlv = next_tlv + tlv_len + 2; > > Would be nice to define the magic number (2), since we're reusing it now. There is a pending patch in review that defines IXGBE_E610_SR_PFA_TLV_HDR_SIZE, which fits perfectly here. > >> } >> /* Module does not exist */ > > Thanks, > Marcin Thanks, Tomasz