From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 472A437C0EC for ; Tue, 28 Jul 2026 16:29:51 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1785256192; cv=none; b=Iueomiw0zxZe6QVQZz6BnlE7zDrItAnZ9PVRSO+ZIlk4iF2gyZIv+6DxnQudl+tw6TLL8NufqTop28m3YgH1zGbQxoyI8Pi/5u6d+117aBNXL8Rfl39FG3gVEgAKcRtwWtKnpJ0gpc+at6RlCgoN7nLaw1NBOb0FV+BZq+uJB/8= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1785256192; c=relaxed/simple; bh=Mew4B/FE2veIHiEYZheR7SHm6s0mmBQnEQwLx/cQ/0c=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=CI0J+EkKAVtqSwY/tkqhXExImU7darxdsj+/DWhkmlm7vZe5lFGhKKWrPli4VlgVxozhqI+ClRmLUF2iDF7KFgAIfmJz30AHujwIKYnfDMwExyu909HkeeJpuNl4BT7oQeyqJzZfgoDt4tOVwreU6hyDr9bs6qWdSBJwQCCJVLo= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=RZakRMlP; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="RZakRMlP" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 3AE5B1F000E9; Tue, 28 Jul 2026 16:29:50 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kernel.org; s=k20260515; t=1785256190; bh=fSjSbRYQlAJ7sVxTVKNRVhOkBC3jlBhIDbeyD665WIw=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=RZakRMlPI4bADlDcF7FCwBSPY817lUsMXfcPS2DPvGUkSUr7nqYPRHUMz4AmWwOHI l92ZzXH0y+VKgMA/QwFTcR8owOWD02klArXOIn0zvg3e98dYidECPKnw5mhW2h6/sT zEdL2CQCjNmX5DUIKDdB1qg7diZNHTlxKSyeohLjDfVbqCcjkpIj31KCrR6EpORZev zeGwb6oHxH/B8uI5XYcqE0Az5H5zOK3DZ05dq+x3kxQpcgcjMkH60ULbSoDei98gwp G2+wZgTiQpPUWEoy0nxnSenxBS5Tjw4oD1ymbgBMufZYASfyRLe6yGHWMAR5rCcknE vHx2tn0oLEF+Q== From: Sasha Levin To: stable@vger.kernel.org Cc: Junrui Luo , Yuhao Jiang , Jakub Kicinski , Sasha Levin Subject: [PATCH 6.1.y] octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF Date: Tue, 28 Jul 2026 12:29:48 -0400 Message-ID: <20260728162948.99838-1-sashal@kernel.org> X-Mailer: git-send-email 2.53.0 In-Reply-To: <2026072018-negotiate-settle-bdca@gregkh> References: <2026072018-negotiate-settle-bdca@gregkh> Precedence: bulk X-Mailing-List: stable@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit From: Junrui Luo [ Upstream commit 8cdcf3d2caacdee7ddd363705fb4d93b0c1a0915 ] rvu_mbox_handler_lmtst_tbl_setup() uses req->base_pcifunc as a direct index into the LMT map table to read another function's LMTLINE physical base address and copy it into the caller's own LMT map table entry. The mailbox dispatcher authenticates req->hdr.pcifunc from the IRQ source, but req->base_pcifunc is a separate payload field and is not sanitized. Reject the request with -EPERM when a VF caller's base_pcifunc is not a valid function under its own PF. is_pf_func_valid() bounds the FUNC field to the PF's configured VF count, keeping the computed index inside the caller's own slot block. Fixes: 893ae97214c3 ("octeontx2-af: cn10k: Support configurable LMTST regions") Reported-by: Yuhao Jiang Cc: stable@vger.kernel.org Signed-off-by: Junrui Luo Link: https://patch.msgid.link/SYBPR01MB78811656934E713B77DA6CEDAFE62@SYBPR01MB7881.ausprd01.prod.outlook.com Signed-off-by: Jakub Kicinski [ Dropped `rvu->pdev` argument from `rvu_get_pf()` calls and folded in the `is_pf_func_valid()` de-static plus its `rvu.h` declaration from commit 2156a29aecff. ] Signed-off-by: Sasha Levin --- drivers/net/ethernet/marvell/octeontx2/af/rvu.c | 2 +- drivers/net/ethernet/marvell/octeontx2/af/rvu.h | 1 + drivers/net/ethernet/marvell/octeontx2/af/rvu_cn10k.c | 9 +++++++++ 3 files changed, 11 insertions(+), 1 deletion(-) diff --git a/drivers/net/ethernet/marvell/octeontx2/af/rvu.c b/drivers/net/ethernet/marvell/octeontx2/af/rvu.c index 3bb035c60339b0..c9a2813b1785da 100644 --- a/drivers/net/ethernet/marvell/octeontx2/af/rvu.c +++ b/drivers/net/ethernet/marvell/octeontx2/af/rvu.c @@ -440,7 +440,7 @@ struct rvu_pfvf *rvu_get_pfvf(struct rvu *rvu, int pcifunc) return &rvu->pf[rvu_get_pf(pcifunc)]; } -static bool is_pf_func_valid(struct rvu *rvu, u16 pcifunc) +bool is_pf_func_valid(struct rvu *rvu, u16 pcifunc) { int pf, vf, nvfs; u64 cfg; diff --git a/drivers/net/ethernet/marvell/octeontx2/af/rvu.h b/drivers/net/ethernet/marvell/octeontx2/af/rvu.h index 86ef67745ebdf7..c0a2f4ca5c17a3 100644 --- a/drivers/net/ethernet/marvell/octeontx2/af/rvu.h +++ b/drivers/net/ethernet/marvell/octeontx2/af/rvu.h @@ -718,6 +718,7 @@ int rvu_get_pf(u16 pcifunc); struct rvu_pfvf *rvu_get_pfvf(struct rvu *rvu, int pcifunc); void rvu_get_pf_numvfs(struct rvu *rvu, int pf, int *numvfs, int *hwvf); bool is_block_implemented(struct rvu_hwinfo *hw, int blkaddr); +bool is_pf_func_valid(struct rvu *rvu, u16 pcifunc); bool is_pffunc_map_valid(struct rvu *rvu, u16 pcifunc, int blktype); int rvu_get_lf(struct rvu *rvu, struct rvu_block *block, u16 pcifunc, u16 slot); int rvu_lf_reset(struct rvu *rvu, struct rvu_block *block, int lf); diff --git a/drivers/net/ethernet/marvell/octeontx2/af/rvu_cn10k.c b/drivers/net/ethernet/marvell/octeontx2/af/rvu_cn10k.c index 5cd45846237e2f..b61655f7404121 100644 --- a/drivers/net/ethernet/marvell/octeontx2/af/rvu_cn10k.c +++ b/drivers/net/ethernet/marvell/octeontx2/af/rvu_cn10k.c @@ -178,6 +178,15 @@ int rvu_mbox_handler_lmtst_tbl_setup(struct rvu *rvu, * pcifunc (will be the one who is calling this mailbox). */ if (req->base_pcifunc) { + /* A VF is untrusted and must not redirect its LMTLINE to + * another PF's region, so confine VF callers to their own PF. + */ + if (is_vf(req->hdr.pcifunc) && + (!is_pf_func_valid(rvu, req->base_pcifunc) || + rvu_get_pf(req->hdr.pcifunc) != + rvu_get_pf(req->base_pcifunc))) + return -EPERM; + /* Calculating the LMT table index equivalent to primary * pcifunc. */ -- 2.53.0