* [PATCH] ixgbe: validate E610 PFA TLV bounds
@ 2026-07-06 9:25 Pengpeng Hou
2026-07-06 10:02 ` [Intel-wired-lan] " Marcin Szycik
2026-07-06 14:01 ` Przemek Kitszel
0 siblings, 2 replies; 4+ messages in thread
From: Pengpeng Hou @ 2026-07-06 9:25 UTC (permalink / raw)
To: Tony Nguyen
Cc: Pengpeng Hou, Przemek Kitszel, Andrew Lunn, David S. Miller,
Eric Dumazet, Jakub Kicinski, Paolo Abeni, intel-wired-lan,
netdev, linux-kernel
ixgbe_get_pfa_module_tlv() walks E610 PFA TLV records stored in
EEPROM.
Stop parsing malformed TLVs whose header or declared value length would
exceed the PFA boundary.
Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn>
---
drivers/net/ethernet/intel/ixgbe/ixgbe_e610.c | 6 ++++++
1 file changed, 6 insertions(+)
diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_e610.c b/drivers/net/ethernet/intel/ixgbe/ixgbe_e610.c
index 4d8ae5b56145..03e88bdf5a43 100644
--- a/drivers/net/ethernet/intel/ixgbe/ixgbe_e610.c
+++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_e610.c
@@ -3895,6 +3895,9 @@ static int ixgbe_get_pfa_module_tlv(struct ixgbe_hw *hw, u16 *module_tlv,
while (next_tlv < pfa_end_ptr) {
u16 tlv_sub_module_type, tlv_len;
+ if (pfa_end_ptr - next_tlv < 2)
+ break;
+
/* Read TLV type */
err = ixgbe_read_ee_aci_e610(hw, next_tlv,
&tlv_sub_module_type);
@@ -3917,6 +3920,9 @@ static int ixgbe_get_pfa_module_tlv(struct ixgbe_hw *hw, u16 *module_tlv,
/* Check next TLV, i.e. current TLV pointer + length + 2 words
* (for current TLV's type and length).
*/
+ if (tlv_len > pfa_end_ptr - next_tlv - 2)
+ break;
+
next_tlv = next_tlv + tlv_len + 2;
}
/* Module does not exist */
--
2.43.0
^ permalink raw reply related [flat|nested] 4+ messages in thread
* Re: [Intel-wired-lan] [PATCH] ixgbe: validate E610 PFA TLV bounds
2026-07-06 9:25 [PATCH] ixgbe: validate E610 PFA TLV bounds Pengpeng Hou
@ 2026-07-06 10:02 ` Marcin Szycik
2026-07-06 13:14 ` Tomasz Lichwala
2026-07-06 14:01 ` Przemek Kitszel
1 sibling, 1 reply; 4+ messages in thread
From: Marcin Szycik @ 2026-07-06 10:02 UTC (permalink / raw)
To: Pengpeng Hou, Tony Nguyen
Cc: Przemek Kitszel, Andrew Lunn, David S. Miller, Eric Dumazet,
Jakub Kicinski, Paolo Abeni, intel-wired-lan, netdev,
linux-kernel
On 06/07/2026 11:25, Pengpeng Hou wrote:
> ixgbe_get_pfa_module_tlv() walks E610 PFA TLV records stored in
> EEPROM.
>
> Stop parsing malformed TLVs whose header or declared value length would
> exceed the PFA boundary.
>
> Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn>
> ---
> drivers/net/ethernet/intel/ixgbe/ixgbe_e610.c | 6 ++++++
> 1 file changed, 6 insertions(+)
>
> diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_e610.c b/drivers/net/ethernet/intel/ixgbe/ixgbe_e610.c
> index 4d8ae5b56145..03e88bdf5a43 100644
> --- a/drivers/net/ethernet/intel/ixgbe/ixgbe_e610.c
> +++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_e610.c
> @@ -3895,6 +3895,9 @@ static int ixgbe_get_pfa_module_tlv(struct ixgbe_hw *hw, u16 *module_tlv,
> while (next_tlv < pfa_end_ptr) {
> u16 tlv_sub_module_type, tlv_len;
>
> + if (pfa_end_ptr - next_tlv < 2)
> + break;
This check could go in the while condition above.
> +
> /* Read TLV type */
> err = ixgbe_read_ee_aci_e610(hw, next_tlv,
> &tlv_sub_module_type);
> @@ -3917,6 +3920,9 @@ static int ixgbe_get_pfa_module_tlv(struct ixgbe_hw *hw, u16 *module_tlv,
> /* Check next TLV, i.e. current TLV pointer + length + 2 words
> * (for current TLV's type and length).
> */
> + if (tlv_len > pfa_end_ptr - next_tlv - 2)
> + break;
> +
> next_tlv = next_tlv + tlv_len + 2;
Would be nice to define the magic number (2), since we're reusing it now.
> }
> /* Module does not exist */
Thanks,
Marcin
^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: [Intel-wired-lan] [PATCH] ixgbe: validate E610 PFA TLV bounds
2026-07-06 10:02 ` [Intel-wired-lan] " Marcin Szycik
@ 2026-07-06 13:14 ` Tomasz Lichwala
0 siblings, 0 replies; 4+ messages in thread
From: Tomasz Lichwala @ 2026-07-06 13:14 UTC (permalink / raw)
To: Marcin Szycik, Pengpeng Hou, Tony Nguyen
Cc: Przemek Kitszel, Andrew Lunn, David S. Miller, Eric Dumazet,
Jakub Kicinski, Paolo Abeni, intel-wired-lan, netdev,
linux-kernel
W dniu 6.07.2026 o 12:02, Marcin Szycik pisze:
>
>
> On 06/07/2026 11:25, Pengpeng Hou wrote:
>> ixgbe_get_pfa_module_tlv() walks E610 PFA TLV records stored in
>> EEPROM.
>>
>> Stop parsing malformed TLVs whose header or declared value length would
>> exceed the PFA boundary.
>>
>> Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn>
>> ---
>> drivers/net/ethernet/intel/ixgbe/ixgbe_e610.c | 6 ++++++
>> 1 file changed, 6 insertions(+)
>>
>> diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_e610.c b/drivers/net/ethernet/intel/ixgbe/ixgbe_e610.c
>> index 4d8ae5b56145..03e88bdf5a43 100644
>> --- a/drivers/net/ethernet/intel/ixgbe/ixgbe_e610.c
>> +++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_e610.c
>> @@ -3895,6 +3895,9 @@ static int ixgbe_get_pfa_module_tlv(struct ixgbe_hw *hw, u16 *module_tlv,
>> while (next_tlv < pfa_end_ptr) {
>> u16 tlv_sub_module_type, tlv_len;
>>
>> + if (pfa_end_ptr - next_tlv < 2)
>> + break;
>
> This check could go in the while condition above.
>
>> +
>> /* Read TLV type */
>> err = ixgbe_read_ee_aci_e610(hw, next_tlv,
>> &tlv_sub_module_type);
>> @@ -3917,6 +3920,9 @@ static int ixgbe_get_pfa_module_tlv(struct ixgbe_hw *hw, u16 *module_tlv,
>> /* Check next TLV, i.e. current TLV pointer + length + 2 words
>> * (for current TLV's type and length).
>> */
>> + if (tlv_len > pfa_end_ptr - next_tlv - 2)
>> + break;
>> +
>> next_tlv = next_tlv + tlv_len + 2;
>
> Would be nice to define the magic number (2), since we're reusing it now.
There is a pending patch in review that defines IXGBE_E610_SR_PFA_TLV_HDR_SIZE, which fits perfectly here.
>
>> }
>> /* Module does not exist */
>
> Thanks,
> Marcin
Thanks,
Tomasz
^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: [PATCH] ixgbe: validate E610 PFA TLV bounds
2026-07-06 9:25 [PATCH] ixgbe: validate E610 PFA TLV bounds Pengpeng Hou
2026-07-06 10:02 ` [Intel-wired-lan] " Marcin Szycik
@ 2026-07-06 14:01 ` Przemek Kitszel
1 sibling, 0 replies; 4+ messages in thread
From: Przemek Kitszel @ 2026-07-06 14:01 UTC (permalink / raw)
To: Pengpeng Hou
Cc: Andrew Lunn, David S. Miller, Eric Dumazet, Tony Nguyen,
Jakub Kicinski, Paolo Abeni, intel-wired-lan, netdev,
linux-kernel
For the future please tag your intel ethernet submissions as
iwl-net (fixes) or iwl-next (refactors/features).
(Applies to v2 of this series).
On 7/6/26 11:25, Pengpeng Hou wrote:
> ixgbe_get_pfa_module_tlv() walks E610 PFA TLV records stored in
> EEPROM.
>
> Stop parsing malformed TLVs whose header or declared value length would
> exceed the PFA boundary.
this is a "beware of malicious NVM" type of change...
>
> Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn>
> ---
> drivers/net/ethernet/intel/ixgbe/ixgbe_e610.c | 6 ++++++
> 1 file changed, 6 insertions(+)
>
> diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_e610.c b/drivers/net/ethernet/intel/ixgbe/ixgbe_e610.c
> index 4d8ae5b56145..03e88bdf5a43 100644
> --- a/drivers/net/ethernet/intel/ixgbe/ixgbe_e610.c
> +++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_e610.c
> @@ -3895,6 +3895,9 @@ static int ixgbe_get_pfa_module_tlv(struct ixgbe_hw *hw, u16 *module_tlv,
> while (next_tlv < pfa_end_ptr) {
> u16 tlv_sub_module_type, tlv_len;
>
> + if (pfa_end_ptr - next_tlv < 2)
instead of wrap-around arithmetics it would be better to use
size_add/size_sub
> + break;
> +
> /* Read TLV type */
> err = ixgbe_read_ee_aci_e610(hw, next_tlv,
> &tlv_sub_module_type);
> @@ -3917,6 +3920,9 @@ static int ixgbe_get_pfa_module_tlv(struct ixgbe_hw *hw, u16 *module_tlv,
> /* Check next TLV, i.e. current TLV pointer + length + 2 words
> * (for current TLV's type and length).
> */
> + if (tlv_len > pfa_end_ptr - next_tlv - 2)
> + break;
> +
> next_tlv = next_tlv + tlv_len + 2;
> }
> /* Module does not exist */
^ permalink raw reply [flat|nested] 4+ messages in thread
end of thread, other threads:[~2026-07-06 14:00 UTC | newest]
Thread overview: 4+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-07-06 9:25 [PATCH] ixgbe: validate E610 PFA TLV bounds Pengpeng Hou
2026-07-06 10:02 ` [Intel-wired-lan] " Marcin Szycik
2026-07-06 13:14 ` Tomasz Lichwala
2026-07-06 14:01 ` Przemek Kitszel
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox