From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id ED2FD43E9DF for ; Tue, 28 Jul 2026 13:30:42 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1785245447; cv=none; b=OffctrHTiytTTGnPZhmC/7+CSPUV8PjDH219P4JqNIkIUPzLhlSplr05tSdqaBrvSIwHVP8ifEDYubfXvnv/UDc+9eIE1LYV3ECjnVPV3tYGXmw6Ddt+fX7NLBwxx/k/8LjrR7L+n3JoWMUt/Yv7NA9oSsaH4WF84iZIAqbtKTk= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1785245447; c=relaxed/simple; bh=gZ3y59z/VrRljvf7WP4oJhr8r/OVtZOqdky7iDA2B6Q=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=nFiSWmsdciyMM1s8ae1hxjmMYpWSugFoJhlmpC7fPV3l2aBi8m3PW5x7q8HxqhIHfAApI86lj3jBPCyAujhNPX5BKR+XlprEjJP0p911WpZ+nHvYYkWHoAcM8cl1bl+EubcDW11zM45zDrbNqKuiBVfDajhqrkTdPD88F56Rj2g= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=H5i4XQng; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="H5i4XQng" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 8A5C01F00A3F; Tue, 28 Jul 2026 13:30:39 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kernel.org; s=k20260515; t=1785245440; bh=NBJyQztEO2pbGflHEMHOt10js5UM0h30P1OMqb5oKxQ=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=H5i4XQngwNddcBjpmHRQ5Rl8qk/enFy4vROLF/15FKNwHvnYk2o+Szbzv7JYpkCyu 8lZ9DKwG8naz8uPsiQqx0N72j/I7uIaqnQb1X+N+f935SRKzldUtjyA18o6AzzxSSO rEA9fXDnzSMY4/DM3VvGEWpl2C+Ae8tbBvbqPboy9kyAJSQTN9S7lnmpIFrM0G2l9j 80eD7vE9srVcJaMelWPqLol4UGvH0DiSA8gTb9aOQvIwwlN1qkwPC9p60HcPYriOVL oTCV6nGdqqGYffRFOX60oVNkp5oY6xq62znbK2IUgrPn1QGZCeKOjS9mSxjNYqiJlW nHIgWtgTOgXYQ== From: Sasha Levin To: stable@vger.kernel.org Cc: Junrui Luo , Yuhao Jiang , Jakub Kicinski , Sasha Levin Subject: [PATCH 6.18.y 2/2] octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF Date: Tue, 28 Jul 2026 09:30:37 -0400 Message-ID: <20260728133037.3965153-2-sashal@kernel.org> X-Mailer: git-send-email 2.53.0 In-Reply-To: <20260728133037.3965153-1-sashal@kernel.org> References: <2026072017-removal-sequester-79b2@gregkh> <20260728133037.3965153-1-sashal@kernel.org> Precedence: bulk X-Mailing-List: stable@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit From: Junrui Luo [ Upstream commit 8cdcf3d2caacdee7ddd363705fb4d93b0c1a0915 ] rvu_mbox_handler_lmtst_tbl_setup() uses req->base_pcifunc as a direct index into the LMT map table to read another function's LMTLINE physical base address and copy it into the caller's own LMT map table entry. The mailbox dispatcher authenticates req->hdr.pcifunc from the IRQ source, but req->base_pcifunc is a separate payload field and is not sanitized. Reject the request with -EPERM when a VF caller's base_pcifunc is not a valid function under its own PF. is_pf_func_valid() bounds the FUNC field to the PF's configured VF count, keeping the computed index inside the caller's own slot block. Fixes: 893ae97214c3 ("octeontx2-af: cn10k: Support configurable LMTST regions") Reported-by: Yuhao Jiang Cc: stable@vger.kernel.org Signed-off-by: Junrui Luo Link: https://patch.msgid.link/SYBPR01MB78811656934E713B77DA6CEDAFE62@SYBPR01MB7881.ausprd01.prod.outlook.com Signed-off-by: Jakub Kicinski Signed-off-by: Sasha Levin --- drivers/net/ethernet/marvell/octeontx2/af/rvu_cn10k.c | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/drivers/net/ethernet/marvell/octeontx2/af/rvu_cn10k.c b/drivers/net/ethernet/marvell/octeontx2/af/rvu_cn10k.c index d2163da28d18f0..fa4ea1258d29d5 100644 --- a/drivers/net/ethernet/marvell/octeontx2/af/rvu_cn10k.c +++ b/drivers/net/ethernet/marvell/octeontx2/af/rvu_cn10k.c @@ -178,6 +178,15 @@ int rvu_mbox_handler_lmtst_tbl_setup(struct rvu *rvu, * pcifunc (will be the one who is calling this mailbox). */ if (req->base_pcifunc) { + /* A VF is untrusted and must not redirect its LMTLINE to + * another PF's region, so confine VF callers to their own PF. + */ + if (is_vf(req->hdr.pcifunc) && + (!is_pf_func_valid(rvu, req->base_pcifunc) || + rvu_get_pf(rvu->pdev, req->hdr.pcifunc) != + rvu_get_pf(rvu->pdev, req->base_pcifunc))) + return -EPERM; + /* Calculating the LMT table index equivalent to primary * pcifunc. */ -- 2.53.0