From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: stable@vger.kernel.org
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
patches@lists.linux.dev,
Lukasz Czapnik <lukasz.czapnik@intel.com>,
Aleksandr Loktionov <aleksandr.loktionov@intel.com>,
Przemek Kitszel <przemyslaw.kitszel@intel.com>,
Simon Horman <horms@kernel.org>,
Rafal Romanowski <rafal.romanowski@intel.com>,
Tony Nguyen <anthony.l.nguyen@intel.com>
Subject: [PATCH 6.1 47/73] i40e: fix input validation logic for action_meta
Date: Tue, 30 Sep 2025 16:47:51 +0200 [thread overview]
Message-ID: <20250930143822.569327786@linuxfoundation.org> (raw)
In-Reply-To: <20250930143820.537407601@linuxfoundation.org>
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lukasz Czapnik <lukasz.czapnik@intel.com>
commit 9739d5830497812b0bdeaee356ddefbe60830b88 upstream.
Fix condition to check 'greater or equal' to prevent OOB dereference.
Fixes: e284fc280473 ("i40e: Add and delete cloud filter")
Cc: stable@vger.kernel.org
Signed-off-by: Lukasz Czapnik <lukasz.czapnik@intel.com>
Reviewed-by: Aleksandr Loktionov <aleksandr.loktionov@intel.com>
Signed-off-by: Przemek Kitszel <przemyslaw.kitszel@intel.com>
Reviewed-by: Simon Horman <horms@kernel.org>
Tested-by: Rafal Romanowski <rafal.romanowski@intel.com>
Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c
+++ b/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c
@@ -3525,7 +3525,7 @@ static int i40e_validate_cloud_filter(st
/* action_meta is TC number here to which the filter is applied */
if (!tc_filter->action_meta ||
- tc_filter->action_meta > vf->num_tc) {
+ tc_filter->action_meta >= vf->num_tc) {
dev_info(&pf->pdev->dev, "VF %d: Invalid TC number %u\n",
vf->vf_id, tc_filter->action_meta);
goto err;
next prev parent reply other threads:[~2025-09-30 15:18 UTC|newest]
Thread overview: 86+ messages / expand[flat|nested] mbox.gz Atom feed top
2025-09-30 14:47 [PATCH 6.1 00/73] 6.1.155-rc1 review Greg Kroah-Hartman
2025-09-30 14:47 ` [PATCH 6.1 01/73] ALSA: usb-audio: Fix block comments in mixer_quirks Greg Kroah-Hartman
2025-09-30 14:47 ` [PATCH 6.1 02/73] ALSA: usb-audio: Drop unnecessary parentheses " Greg Kroah-Hartman
2025-09-30 14:47 ` [PATCH 6.1 03/73] ALSA: usb-audio: Avoid multiple assignments " Greg Kroah-Hartman
2025-09-30 14:47 ` [PATCH 6.1 04/73] ALSA: usb-audio: Simplify NULL comparison " Greg Kroah-Hartman
2025-09-30 14:47 ` [PATCH 6.1 05/73] ALSA: usb-audio: Remove unneeded wmb() " Greg Kroah-Hartman
2025-09-30 14:47 ` [PATCH 6.1 06/73] ALSA: usb-audio: Add mixer quirk for Sony DualSense PS5 Greg Kroah-Hartman
2025-09-30 14:47 ` [PATCH 6.1 07/73] HID: multitouch: Get the contact ID from HID_DG_TRANSDUCER_INDEX fields in case of Apple Touch Bar Greg Kroah-Hartman
2025-09-30 15:23 ` Aditya Garg
2025-10-02 7:09 ` Greg Kroah-Hartman
2025-09-30 14:47 ` [PATCH 6.1 08/73] HID: multitouch: support getting the tip state from HID_DG_TOUCH fields in " Greg Kroah-Hartman
2025-09-30 14:47 ` [PATCH 6.1 09/73] HID: multitouch: take cls->maxcontacts into account for Apple Touch Bar even without a HID_DG_CONTACTMAX field Greg Kroah-Hartman
2025-09-30 14:47 ` [PATCH 6.1 10/73] HID: multitouch: specify that Apple Touch Bar is direct Greg Kroah-Hartman
2025-09-30 14:47 ` [PATCH 6.1 11/73] ALSA: usb-audio: Convert comma to semicolon Greg Kroah-Hartman
2025-09-30 14:47 ` [PATCH 6.1 12/73] ALSA: usb-audio: Fix build with CONFIG_INPUT=n Greg Kroah-Hartman
2025-09-30 14:47 ` [PATCH 6.1 13/73] usb: core: Add 0x prefix to quirks debug output Greg Kroah-Hartman
2025-09-30 14:47 ` [PATCH 6.1 14/73] ALSA: usb-audio: Add DSD support for Comtrue USB Audio device Greg Kroah-Hartman
2025-09-30 14:47 ` [PATCH 6.1 15/73] ALSA: usb-audio: move mixer_quirks min_mute into common quirk Greg Kroah-Hartman
2025-09-30 14:47 ` [PATCH 6.1 16/73] ALSA: usb-audio: Add mute TLV for playback volumes on more devices Greg Kroah-Hartman
2025-09-30 14:47 ` [PATCH 6.1 17/73] IB/mlx5: Fix obj_type mismatch for SRQ event subscriptions Greg Kroah-Hartman
2025-09-30 14:47 ` [PATCH 6.1 18/73] mm/gup: revert "mm: gup: fix infinite loop within __get_longterm_locked" Greg Kroah-Hartman
2025-09-30 14:47 ` [PATCH 6.1 19/73] mm: add folio_expected_ref_count() for reference count calculation Greg Kroah-Hartman
2025-09-30 14:47 ` [PATCH 6.1 20/73] mm/gup: check ref_count instead of lru before migration Greg Kroah-Hartman
2025-09-30 14:47 ` [PATCH 6.1 21/73] mm/gup: local lru_add_drain() to avoid lru_add_drain_all() Greg Kroah-Hartman
2025-09-30 14:47 ` [PATCH 6.1 22/73] mm: folio_may_be_lru_cached() unless folio_test_large() Greg Kroah-Hartman
2025-09-30 14:47 ` [PATCH 6.1 23/73] arm64: dts: imx8mp: Correct thermal sensor index Greg Kroah-Hartman
2025-09-30 14:47 ` [PATCH 6.1 24/73] cpufreq: Initialize cpufreq-based invariance before subsys Greg Kroah-Hartman
2025-09-30 14:47 ` [PATCH 6.1 25/73] smb: server: dont use delayed_work for post_recv_credits_work Greg Kroah-Hartman
2025-09-30 14:47 ` [PATCH 6.1 26/73] can: rcar_can: rcar_can_resume(): fix s2ram with PSCI Greg Kroah-Hartman
2025-09-30 14:47 ` [PATCH 6.1 27/73] bpf: Reject bpf_timer for PREEMPT_RT Greg Kroah-Hartman
2025-09-30 14:47 ` [PATCH 6.1 28/73] can: etas_es58x: sort the includes by alphabetic order Greg Kroah-Hartman
2025-09-30 14:47 ` [PATCH 6.1 29/73] can: etas_es58x: populate ndo_change_mtu() to prevent buffer overflow Greg Kroah-Hartman
2025-09-30 14:47 ` [PATCH 6.1 30/73] can: hi311x: " Greg Kroah-Hartman
2025-09-30 14:47 ` [PATCH 6.1 31/73] can: sun4i_can: " Greg Kroah-Hartman
2025-09-30 14:47 ` [PATCH 6.1 32/73] can: mcba_usb: " Greg Kroah-Hartman
2025-09-30 14:47 ` [PATCH 6.1 33/73] can: peak_usb: fix shift-out-of-bounds issue Greg Kroah-Hartman
2025-09-30 14:47 ` [PATCH 6.1 34/73] ethernet: rvu-af: Remove slash from the driver name Greg Kroah-Hartman
2025-09-30 14:47 ` [PATCH 6.1 35/73] Bluetooth: hci_sync: Fix hci_resume_advertising_sync Greg Kroah-Hartman
2025-09-30 14:47 ` [PATCH 6.1 36/73] Bluetooth: hci_event: Fix UAF in hci_acl_create_conn_sync Greg Kroah-Hartman
2025-09-30 14:47 ` [PATCH 6.1 37/73] bnxt_en: correct offset handling for IPv6 destination address Greg Kroah-Hartman
2025-09-30 14:47 ` [PATCH 6.1 38/73] nexthop: Forbid FDB status change while nexthop is in a group Greg Kroah-Hartman
2025-09-30 14:47 ` [PATCH 6.1 39/73] selftests: fib_nexthops: Fix creation of non-FDB nexthops Greg Kroah-Hartman
2025-09-30 14:47 ` [PATCH 6.1 40/73] net: dsa: lantiq_gswip: do also enable or disable cpu port Greg Kroah-Hartman
2025-09-30 14:47 ` [PATCH 6.1 41/73] net: dsa: lantiq_gswip: move gswip_add_single_port_br() call to port_setup() Greg Kroah-Hartman
2025-09-30 14:47 ` [PATCH 6.1 42/73] net: dsa: lantiq_gswip: suppress -EINVAL errors for bridge FDB entries added to the CPU port Greg Kroah-Hartman
2025-09-30 14:47 ` [PATCH 6.1 43/73] octeontx2-pf: Fix potential use after free in otx2_tc_add_flow() Greg Kroah-Hartman
2025-09-30 14:47 ` [PATCH 6.1 44/73] drm/gma500: Fix null dereference in hdmi teardown Greg Kroah-Hartman
2025-09-30 14:47 ` [PATCH 6.1 45/73] futex: Prevent use-after-free during requeue-PI Greg Kroah-Hartman
2025-09-30 14:47 ` [PATCH 6.1 46/73] i40e: fix idx validation in i40e_validate_queue_map Greg Kroah-Hartman
2025-09-30 14:47 ` Greg Kroah-Hartman [this message]
2025-09-30 14:47 ` [PATCH 6.1 48/73] i40e: add max boundary check for VF filters Greg Kroah-Hartman
2025-09-30 14:47 ` [PATCH 6.1 49/73] i40e: add mask to apply valid bits for itr_idx Greg Kroah-Hartman
2025-09-30 14:47 ` [PATCH 6.1 50/73] i40e: improve VF MAC filters accounting Greg Kroah-Hartman
2025-09-30 14:47 ` [PATCH 6.1 51/73] crypto: af_alg - Fix incorrect boolean values in af_alg_ctx Greg Kroah-Hartman
2025-09-30 14:47 ` [PATCH 6.1 52/73] tracing: dynevent: Add a missing lockdown check on dynevent Greg Kroah-Hartman
2025-09-30 14:47 ` [PATCH 6.1 53/73] afs: Fix potential null pointer dereference in afs_put_server Greg Kroah-Hartman
2025-09-30 14:47 ` [PATCH 6.1 54/73] mm/hugetlb: fix folio is still mapped when deleted Greg Kroah-Hartman
2025-09-30 14:47 ` [PATCH 6.1 55/73] fbcon: fix integer overflow in fbcon_do_set_font Greg Kroah-Hartman
2025-09-30 14:48 ` [PATCH 6.1 56/73] fbcon: Fix OOB access in font allocation Greg Kroah-Hartman
2025-09-30 14:48 ` [PATCH 6.1 57/73] s390/cpum_cf: Fix uninitialized warning after backport of ce971233242b Greg Kroah-Hartman
2025-09-30 14:48 ` [PATCH 6.1 58/73] mm: migrate_device: use more folio in migrate_device_finalize() Greg Kroah-Hartman
2025-09-30 14:48 ` [PATCH 6.1 59/73] mm/migrate_device: dont add folio to be freed to LRU " Greg Kroah-Hartman
2025-09-30 14:48 ` [PATCH 6.1 60/73] minmax: add in_range() macro Greg Kroah-Hartman
2025-09-30 14:48 ` [PATCH 6.1 61/73] minmax: Introduce {min,max}_array() Greg Kroah-Hartman
2025-09-30 14:48 ` [PATCH 6.1 62/73] minmax: deduplicate __unconst_integer_typeof() Greg Kroah-Hartman
2025-09-30 14:48 ` [PATCH 6.1 63/73] minmax: fix indentation of __cmp_once() and __clamp_once() Greg Kroah-Hartman
2025-09-30 14:48 ` [PATCH 6.1 64/73] minmax: avoid overly complicated constant expressions in VM code Greg Kroah-Hartman
2025-09-30 14:48 ` [PATCH 6.1 65/73] drm/ast: Use msleep instead of mdelay for edid read Greg Kroah-Hartman
2025-09-30 14:48 ` [PATCH 6.1 66/73] i40e: fix validation of VF state in get resources Greg Kroah-Hartman
2025-09-30 14:48 ` [PATCH 6.1 67/73] i40e: fix idx validation in config queues msg Greg Kroah-Hartman
2025-09-30 14:48 ` [PATCH 6.1 68/73] i40e: increase max descriptors for XL710 Greg Kroah-Hartman
2025-09-30 14:48 ` [PATCH 6.1 69/73] i40e: add validation for ring_len param Greg Kroah-Hartman
2025-09-30 14:48 ` [PATCH 6.1 70/73] kmsan: fix out-of-bounds access to shadow memory Greg Kroah-Hartman
2025-09-30 14:48 ` [PATCH 6.1 71/73] minmax: make generic MIN() and MAX() macros available everywhere Greg Kroah-Hartman
2025-09-30 14:48 ` [PATCH 6.1 72/73] minmax: add a few more MIN_T/MAX_T users Greg Kroah-Hartman
2025-09-30 14:48 ` [PATCH 6.1 73/73] minmax: simplify and clarify min_t()/max_t() implementation Greg Kroah-Hartman
2025-09-30 17:37 ` [PATCH 6.1 00/73] 6.1.155-rc1 review Florian Fainelli
2025-09-30 18:33 ` Peter Schneider
2025-09-30 18:50 ` Brett A C Sheffield
2025-10-01 3:04 ` [PATCH 6.1 00/73] " Ron Economos
2025-10-01 9:11 ` Jon Hunter
2025-10-01 10:16 ` Mark Brown
2025-10-01 11:42 ` Naresh Kamboju
2025-10-01 16:17 ` Shuah Khan
2025-10-01 17:17 ` Miguel Ojeda
2025-10-03 6:57 ` Pavel Machek
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20250930143822.569327786@linuxfoundation.org \
--to=gregkh@linuxfoundation.org \
--cc=aleksandr.loktionov@intel.com \
--cc=anthony.l.nguyen@intel.com \
--cc=horms@kernel.org \
--cc=lukasz.czapnik@intel.com \
--cc=patches@lists.linux.dev \
--cc=przemyslaw.kitszel@intel.com \
--cc=rafal.romanowski@intel.com \
--cc=stable@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox