From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 22F3E1A239A for ; Mon, 29 Sep 2025 11:31:36 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1759145497; cv=none; b=TZgvXnSnUmZRPh0TGGE5osa88FJzWHYqNV0CfETJSqx+LJ/iFkDSr+ALAojMedWfp6ngY5V1zFEYzr1vbqOMQS1vU4/BWLFgBldpa9JUQ0Ie37s+YqDHtifDhUoBYrR4rVC+6sGUfXT+ayPp8fmz7EMFJ978/koBGb6lNV9DQBE= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1759145497; c=relaxed/simple; bh=WhCYq7U9S5XcHYn8vegUmjdX8Guoov/7R35rJkXhGAk=; h=Subject:To:Cc:From:Date:Message-ID:MIME-Version:Content-Type; b=mOxx2BZuKizB6wdPHcnoCkwaWzrKOjxlh28WmTPeMZjNfyDYP1eSiDlJVmjrN86DDyhhXQIYXkZp1l0Onoi9oH+J/WY28Yb2up2Bf02809wL6L8fuCWjh9DgX9DUUmEjw1u1ye/7Phi/wg5uAfQV0Cg/7d0qNmfELtUvkYFgaqc= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=JTspAy5m; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="JTspAy5m" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 40A36C4CEF4; Mon, 29 Sep 2025 11:31:36 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1759145496; bh=WhCYq7U9S5XcHYn8vegUmjdX8Guoov/7R35rJkXhGAk=; h=Subject:To:Cc:From:Date:From; b=JTspAy5m8zPzb2UWZjMjOzHsZ4kq2yPdJP0c84SUmOvikK1iP0vpFvH1vNe4dv1Lv jZz8Q1st29z1P0q2e5EwKVMc9/SXc2VZRC1TmNeYL8iVcWo3Wjfke4SdPyEILGX9XK 16y5yQ/9HV6O26e/90gGF3Qzmwm3zNsZL0tGKp90= Subject: FAILED: patch "[PATCH] i40e: add validation for ring_len param" failed to apply to 6.6-stable tree To: lukasz.czapnik@intel.com,aleksandr.loktionov@intel.com,anthony.l.nguyen@intel.com,horms@kernel.org,przemyslaw.kitszel@intel.com,rafal.romanowski@intel.com Cc: From: Date: Mon, 29 Sep 2025 13:31:34 +0200 Message-ID: <2025092933-confess-manhole-6d70@gregkh> Precedence: bulk X-Mailing-List: stable@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset=ANSI_X3.4-1968 Content-Transfer-Encoding: 8bit The patch below does not apply to the 6.6-stable tree. If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to . To reproduce the conflict and resubmit, you may use the following commands: git fetch https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ linux-6.6.y git checkout FETCH_HEAD git cherry-pick -x 55d225670def06b01af2e7a5e0446fbe946289e8 # git commit -s git send-email --to '' --in-reply-to '2025092933-confess-manhole-6d70@gregkh' --subject-prefix 'PATCH 6.6.y' HEAD^.. Possible dependencies: thanks, greg k-h ------------------ original commit in Linus's tree ------------------ >From 55d225670def06b01af2e7a5e0446fbe946289e8 Mon Sep 17 00:00:00 2001 From: Lukasz Czapnik Date: Wed, 13 Aug 2025 12:45:11 +0200 Subject: [PATCH] i40e: add validation for ring_len param The `ring_len` parameter provided by the virtual function (VF) is assigned directly to the hardware memory context (HMC) without any validation. To address this, introduce an upper boundary check for both Tx and Rx queue lengths. The maximum number of descriptors supported by the hardware is 8k-32. Additionally, enforce alignment constraints: Tx rings must be a multiple of 8, and Rx rings must be a multiple of 32. Fixes: 5c3c48ac6bf5 ("i40e: implement virtual device interface") Cc: stable@vger.kernel.org Signed-off-by: Lukasz Czapnik Reviewed-by: Aleksandr Loktionov Signed-off-by: Przemek Kitszel Reviewed-by: Simon Horman Tested-by: Rafal Romanowski Signed-off-by: Tony Nguyen diff --git a/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c b/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c index 9b8efdeafbcf..cb37b2ac56f1 100644 --- a/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c +++ b/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c @@ -653,6 +653,13 @@ static int i40e_config_vsi_tx_queue(struct i40e_vf *vf, u16 vsi_id, /* only set the required fields */ tx_ctx.base = info->dma_ring_addr / 128; + + /* ring_len has to be multiple of 8 */ + if (!IS_ALIGNED(info->ring_len, 8) || + info->ring_len > I40E_MAX_NUM_DESCRIPTORS_XL710) { + ret = -EINVAL; + goto error_context; + } tx_ctx.qlen = info->ring_len; tx_ctx.rdylist = le16_to_cpu(vsi->info.qs_handle[0]); tx_ctx.rdylist_act = 0; @@ -716,6 +723,13 @@ static int i40e_config_vsi_rx_queue(struct i40e_vf *vf, u16 vsi_id, /* only set the required fields */ rx_ctx.base = info->dma_ring_addr / 128; + + /* ring_len has to be multiple of 32 */ + if (!IS_ALIGNED(info->ring_len, 32) || + info->ring_len > I40E_MAX_NUM_DESCRIPTORS_XL710) { + ret = -EINVAL; + goto error_param; + } rx_ctx.qlen = info->ring_len; if (info->splithdr_enabled) {