Re: [PATCH] ixgbe: validate E610 PFA TLV bounds

[Przemek Kitszel <przemyslaw.kitszel@intel.com>]

For the future please tag your intel ethernet submissions as
iwl-net (fixes) or iwl-next (refactors/features).
(Applies to v2 of this series).

On 7/6/26 11:25, Pengpeng Hou wrote:
> ixgbe_get_pfa_module_tlv() walks E610 PFA TLV records stored in
> EEPROM.
> 
> Stop parsing malformed TLVs whose header or declared value length would
> exceed the PFA boundary.

this is a "beware of malicious NVM" type of change...

> 
> Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn>
> ---
>   drivers/net/ethernet/intel/ixgbe/ixgbe_e610.c | 6 ++++++
>   1 file changed, 6 insertions(+)
> 
> diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_e610.c b/drivers/net/ethernet/intel/ixgbe/ixgbe_e610.c
> index 4d8ae5b56145..03e88bdf5a43 100644
> --- a/drivers/net/ethernet/intel/ixgbe/ixgbe_e610.c
> +++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_e610.c
> @@ -3895,6 +3895,9 @@ static int ixgbe_get_pfa_module_tlv(struct ixgbe_hw *hw, u16 *module_tlv,
>   	while (next_tlv < pfa_end_ptr) {
>   		u16 tlv_sub_module_type, tlv_len;
>   
> +		if (pfa_end_ptr - next_tlv < 2)

instead of wrap-around arithmetics it would be better to use
size_add/size_sub

> +			break;
> +
>   		/* Read TLV type */
>   		err = ixgbe_read_ee_aci_e610(hw, next_tlv,
>   					     &tlv_sub_module_type);
> @@ -3917,6 +3920,9 @@ static int ixgbe_get_pfa_module_tlv(struct ixgbe_hw *hw, u16 *module_tlv,
>   		/* Check next TLV, i.e. current TLV pointer + length + 2 words
>   		 * (for current TLV's type and length).
>   		 */
> +		if (tlv_len > pfa_end_ptr - next_tlv - 2)
> +			break;
> +
>   		next_tlv = next_tlv + tlv_len + 2;
>   	}
>   	/* Module does not exist */