[PATCH net-next] sfc: ensure type is valid before updating seen_gen

[PATCH net-next] sfc: ensure type is valid before updating seen_gen

[edward.cree]

From: Edward Cree <ecree.xilinx@gmail.com>

In the case of invalid or corrupted v2 counter update packets,
 efx_tc_rx_version_2() returns EFX_TC_COUNTER_TYPE_MAX.  In this case
 we should not attempt to update generation counts as this will write
 beyond the end of the seen_gen array.

Reported-by: coverity-bot <keescook+coverity-bot@chromium.org>
Addresses-Coverity-ID: 1527356 ("Memory - illegal accesses")
Fixes: 25730d8be5d8 ("sfc: add extra RX channel to receive MAE counter updates on ef100")
Signed-off-by: Edward Cree <ecree.xilinx@gmail.com>
---
 drivers/net/ethernet/sfc/tc_counters.c | 16 +++++++++-------
 1 file changed, 9 insertions(+), 7 deletions(-)

diff --git a/drivers/net/ethernet/sfc/tc_counters.c b/drivers/net/ethernet/sfc/tc_counters.c
index 2bba5d3a2fdb..d1a91d54c6bb 100644
--- a/drivers/net/ethernet/sfc/tc_counters.c
+++ b/drivers/net/ethernet/sfc/tc_counters.c
@@ -476,13 +476,15 @@ static bool efx_tc_rx(struct efx_rx_queue *rx_queue, u32 mark)
 		goto out;
 	}
 
-	/* Update seen_gen unconditionally, to avoid a missed wakeup if
-	 * we race with efx_mae_stop_counters().
-	 */
-	efx->tc->seen_gen[type] = mark;
-	if (efx->tc->flush_counters &&
-	    (s32)(efx->tc->flush_gen[type] - mark) <= 0)
-		wake_up(&efx->tc->flush_wq);
+	if (type < EFX_TC_COUNTER_TYPE_MAX) {
+		/* Update seen_gen unconditionally, to avoid a missed wakeup if
+		 * we race with efx_mae_stop_counters().
+		 */
+		efx->tc->seen_gen[type] = mark;
+		if (efx->tc->flush_counters &&
+		    (s32)(efx->tc->flush_gen[type] - mark) <= 0)
+			wake_up(&efx->tc->flush_wq);
+	}
 out:
 	efx_free_rx_buffers(rx_queue, rx_buf, 1);
 	channel->rx_pkt_n_frags = 0;

Re: [PATCH net-next] sfc: ensure type is valid before updating seen_gen

[Kees Cook]

On Mon, Nov 21, 2022 at 09:37:08PM +0000, edward.cree@amd.com wrote:
> From: Edward Cree <ecree.xilinx@gmail.com>
> 
> In the case of invalid or corrupted v2 counter update packets,
>  efx_tc_rx_version_2() returns EFX_TC_COUNTER_TYPE_MAX.  In this case
>  we should not attempt to update generation counts as this will write
>  beyond the end of the seen_gen array.
> 
> Reported-by: coverity-bot <keescook+coverity-bot@chromium.org>
> Addresses-Coverity-ID: 1527356 ("Memory - illegal accesses")
> Fixes: 25730d8be5d8 ("sfc: add extra RX channel to receive MAE counter updates on ef100")
> Signed-off-by: Edward Cree <ecree.xilinx@gmail.com>

Reviewed-by: Kees Cook <keescook@chromium.org>

-- 
Kees Cook

Re: [PATCH net-next] sfc: ensure type is valid before updating seen_gen

[patchwork-bot+netdevbpf]

Hello:

This patch was applied to netdev/net-next.git (master)
by David S. Miller <davem@davemloft.net>:

On Mon, 21 Nov 2022 21:37:08 +0000 you wrote:
> From: Edward Cree <ecree.xilinx@gmail.com>
> 
> In the case of invalid or corrupted v2 counter update packets,
>  efx_tc_rx_version_2() returns EFX_TC_COUNTER_TYPE_MAX.  In this case
>  we should not attempt to update generation counts as this will write
>  beyond the end of the seen_gen array.
> 
> [...]

Here is the summary with links:
  - [net-next] sfc: ensure type is valid before updating seen_gen
    https://git.kernel.org/netdev/net-next/c/e80bd08fd75a

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html