[PATCH 1/2 net] net: mvpp2: prevent buffer overflow in mvpp22_rss_ctx()

[PATCH 1/2 net] net: mvpp2: prevent buffer overflow in mvpp22_rss_ctx()

[Dan Carpenter]

The "rss_context" variable comes from the user via  ethtool_get_rxfh().
It can be any u32 value except zero.  Eventually it gets passed to
mvpp22_rss_ctx() and if it is over MVPP22_N_RSS_TABLES (8) then it
results in an array overflow.

Fixes: 895586d5dc32 ("net: mvpp2: cls: Use RSS contexts to handle RSS tables")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
---
 drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c b/drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c
index 1fa60e985b43a..2b5dad2ec650c 100644
--- a/drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c
+++ b/drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c
@@ -4329,6 +4329,8 @@ static int mvpp2_ethtool_get_rxfh_context(struct net_device *dev, u32 *indir,
 
 	if (!mvpp22_rss_is_supported())
 		return -EOPNOTSUPP;
+	if (rss_context >= MVPP22_N_RSS_TABLES)
+		return -EINVAL;
 
 	if (hfunc)
 		*hfunc = ETH_RSS_HASH_CRC32;
-- 
2.26.2

[PATCH 2/2 net] net: mvpp2: cls: Prevent buffer overflow in mvpp2_ethtool_cls_rule_del()

[Dan Carpenter]

The "info->fs.location" is a u32 that comes from the user via the
ethtool_set_rxnfc() function.  We need to check for invalid values to
prevent a buffer overflow.

I copy and pasted this check from the mvpp2_ethtool_cls_rule_ins()
function.

Fixes: 90b509b39ac9 ("net: mvpp2: cls: Add Classification offload support")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
---
 drivers/net/ethernet/marvell/mvpp2/mvpp2_cls.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/net/ethernet/marvell/mvpp2/mvpp2_cls.c b/drivers/net/ethernet/marvell/mvpp2/mvpp2_cls.c
index 8972cdd559e85..7352244c5e68b 100644
--- a/drivers/net/ethernet/marvell/mvpp2/mvpp2_cls.c
+++ b/drivers/net/ethernet/marvell/mvpp2/mvpp2_cls.c
@@ -1428,6 +1428,9 @@ int mvpp2_ethtool_cls_rule_del(struct mvpp2_port *port,
 	struct mvpp2_ethtool_fs *efs;
 	int ret;
 
+	if (info->fs.location >= MVPP2_N_RFS_ENTRIES_PER_FLOW)
+		return -EINVAL;
+
 	efs = port->rfs_rules[info->fs.location];
 	if (!efs)
 		return -EINVAL;
-- 
2.26.2

Re: [PATCH 2/2 net] net: mvpp2: cls: Prevent buffer overflow in mvpp2_ethtool_cls_rule_del()

[David Miller]

From: Dan Carpenter <dan.carpenter@oracle.com>
Date: Wed, 6 May 2020 13:16:56 +0300

> The "info->fs.location" is a u32 that comes from the user via the
> ethtool_set_rxnfc() function.  We need to check for invalid values to
> prevent a buffer overflow.
> 
> I copy and pasted this check from the mvpp2_ethtool_cls_rule_ins()
> function.
> 
> Fixes: 90b509b39ac9 ("net: mvpp2: cls: Add Classification offload support")
> Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>

Applied.

Re: [PATCH 1/2 net] net: mvpp2: prevent buffer overflow in mvpp22_rss_ctx()

[David Miller]

From: Dan Carpenter <dan.carpenter@oracle.com>
Date: Wed, 6 May 2020 13:16:22 +0300

> The "rss_context" variable comes from the user via  ethtool_get_rxfh().
> It can be any u32 value except zero.  Eventually it gets passed to
> mvpp22_rss_ctx() and if it is over MVPP22_N_RSS_TABLES (8) then it
> results in an array overflow.
> 
> Fixes: 895586d5dc32 ("net: mvpp2: cls: Use RSS contexts to handle RSS tables")
> Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>

Applied.