[PATCH 1/5] net: hns3: check cmdq message parameters sent from VF
From: Yufeng Mo <moyufeng@huawei.com> driver inclusion category: bugfix bugzilla: NA CVE: NA ----------------------------------- The parameters sent from VF may be unreliable. If these parameters are used directly, memory overwriting may occur. Therefore, we need to check parameters before using. Signed-off-by: Yufeng Mo <moyufeng@huawei.com> Reviewed-by: Peng Li <lipeng321@huawei.com> Reviewed-by: Weiwei Deng <dengweiwei@huawei.com> Reviewed-by: Zhaohui Zhong <zhongzhaohui@huawei.com> Reviewed-by: Junxin Chen <chenjunxin1@huawei.com> Signed-off-by: Shengzui You <youshengzui@huawei.com> Signed-off-by: Yang Yingliang <yangyingliang@huawei.com> --- .../hisilicon/hns3/hns3pf/hclge_main.c | 7 +++++ .../hisilicon/hns3/hns3pf/hclge_mbx.c | 26 ++++++++++--------- 2 files changed, 21 insertions(+), 12 deletions(-) diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c index 24b86d704e038..9c3ee09a67d7c 100644 --- a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c +++ b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c @@ -9542,12 +9542,19 @@ int hclge_reset_tqp(struct hnae3_handle *handle, u16 queue_id) void hclge_reset_vf_queue(struct hclge_vport *vport, u16 queue_id) { + struct hnae3_handle *handle = &vport->nic; struct hclge_dev *hdev = vport->back; int reset_try_times = 0; int reset_status; u16 queue_gid; int ret; + if (queue_id >= handle->kinfo.num_tqps) { + dev_warn(&hdev->pdev->dev, "Invalid vf queue id(%u)\n", + queue_id); + return; + } + queue_gid = hclge_covert_handle_qid_global(&vport->nic, queue_id); ret = hclge_send_reset_tqp_cmd(hdev, queue_gid, true); diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_mbx.c b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_mbx.c index 72fd997576016..33ca01408cfcb 100644 --- a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_mbx.c +++ b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_mbx.c @@ -167,21 +167,31 @@ static int hclge_get_ring_chain_from_mbx( struct hclge_vport *vport) { struct hnae3_ring_chain_node *cur_chain, *new_chain; + struct hclge_dev *hdev = vport->back; int ring_num; - int i = 0; + int i; ring_num = req->msg.ring_num; if (ring_num > HCLGE_MBX_MAX_RING_CHAIN_PARAM_NUM) return -ENOMEM; + for (i = 0; i < ring_num; i++) { + if (req->msg.param[i].tqp_index >= vport->nic.kinfo.rss_size) { + dev_err(&hdev->pdev->dev, "tqp index(%u) is out of range(0-%u)\n", + req->msg.param[i].tqp_index, + vport->nic.kinfo.rss_size - 1); + return -EINVAL; + } + } + hnae3_set_bit(ring_chain->flag, HNAE3_RING_TYPE_B, - req->msg.param[i].ring_type); + req->msg.param[0].ring_type); ring_chain->tqp_index = hclge_get_queue_id(vport->nic.kinfo.tqp - [req->msg.param[i].tqp_index]); + [req->msg.param[0].tqp_index]); hnae3_set_field(ring_chain->int_gl_idx, HNAE3_RING_GL_IDX_M, - HNAE3_RING_GL_IDX_S, req->msg.param[i].int_gl_index); + HNAE3_RING_GL_IDX_S, req->msg.param[0].int_gl_index); cur_chain = ring_chain; @@ -270,7 +280,6 @@ static int hclge_get_vf_ring_vector_map(struct hclge_vport *vport, #define HCLGE_VECTOR_ID_OFFSET 3 #define HCLGE_RING_VECTOR_MAP_INFO_LEN 4 struct hnae3_ring_chain_node ring_chain; - struct hclge_dev *hdev = vport->back; struct hclge_desc desc; struct hclge_ctrl_vector_chain_cmd *data = (struct hclge_ctrl_vector_chain_cmd *)desc.data; @@ -278,13 +287,6 @@ static int hclge_get_vf_ring_vector_map(struct hclge_vport *vport, u8 int_gl_index; int ret; - if (req->msg.param[0].tqp_index >= vport->nic.kinfo.rss_size) { - dev_err(&hdev->pdev->dev, "tqp index(%u) is out of range(0-%u)\n", - req->msg.param[0].tqp_index, - vport->nic.kinfo.rss_size - 1); - return -EINVAL; - } - req->msg.ring_num = HCLGE_LIMIT_RING_NUM; memset(&ring_chain, 0, sizeof(ring_chain)); -- 2.25.1
From: Guojia Liao <liaoguojia@huawei.com> driver inclusion category: bugfix bugzilla: NA CVE: NA --------------------------------- The input parameters may not be reliable. Before using the rss hash key index, we should check this parameter. Otherwise out-of-bounds array may occur. Signed-off-by: Guojia Liao <liaoguojia@huawei.com> Reviewed-by: Peng Li <lipeng321@huawei.com> Reviewed-by: Weiwei Deng <dengweiwei@huawei.com> Reviewed-by: Zhaohui Zhong <zhongzhaohui@huawei.com> Reviewed-by: Junxin Chen <chenjunxin1@huawei.com> Signed-off-by: Shengzui You <youshengzui@huawei.com> Signed-off-by: Yang Yingliang <yangyingliang@huawei.com> --- .../ethernet/hisilicon/hns3/hns3pf/hclge_mbx.c | 15 +++++++++++++++ 1 file changed, 15 insertions(+) diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_mbx.c b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_mbx.c index 33ca01408cfcb..e04469cfb0b48 100644 --- a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_mbx.c +++ b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_mbx.c @@ -672,6 +672,21 @@ static void hclge_get_rss_key(struct hclge_vport *vport, index = mbx_req->msg.data[0]; + /* The length of RSS key is large than the length of MBX response. + * So multiple times of copy is needed, which is the meaning of "index". + * And RSS key will be copied 'HCLGE_RSS_MBX_RESP_LEN' byte per time. + * If (index * HCLGE_RSS_MBX_RESP_LEN) large than + * (rss_key_size - HCLGE_RSS_MBX_RESP_LEN), it will cause + * "out-of-bounds array" error, So it's necessary to check with it. + */ + if (((index + 1) * HCLGE_RSS_MBX_RESP_LEN) > + sizeof(vport[0].rss_hash_key)) { + dev_warn(&hdev->pdev->dev, + "failed to get the rss hash key, the index(%u) invalid !\n", + index); + return; + } + memcpy(resp_msg->data, &hdev->vport[0].rss_hash_key[index * HCLGE_RSS_MBX_RESP_LEN], HCLGE_RSS_MBX_RESP_LEN); -- 2.25.1
From: Guojia Liao <liaoguojia@huawei.com> driver inclusion category: bugfix bugzilla: NA CVE: NA ------------------------------------- The input parameters may not be reliable. Before using the vlan id, we should check this parameter. Otherwise some unexpect error may occur. Signed-off-by: Guojia Liao <liaoguojia@huawei.com> Reviewed-by: Peng Li <lipeng321@huawei.com> Reviewed-by: Weiwei Deng <dengweiwei@huawei.com> Reviewed-by: Zhaohui Zhong <zhongzhaohui@huawei.com> Reviewed-by: Junxin Chen <chenjunxin1@huawei.com> Signed-off-by: Shengzui You <youshengzui@huawei.com> Signed-off-by: Yang Yingliang <yangyingliang@huawei.com> --- drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c index 9c3ee09a67d7c..082625de7a308 100644 --- a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c +++ b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c @@ -8505,6 +8505,9 @@ static int hclge_set_vlan_filter_hw(struct hclge_dev *hdev, __be16 proto, if (is_kill && !vlan_id) return 0; + if (vlan_id >= VLAN_N_VID) + return -EINVAL; + ret = hclge_set_vf_vlan_common(hdev, vport_id, is_kill, vlan_id, proto); if (ret) { -- 2.25.1
From: Yufeng Mo <moyufeng@huawei.com> driver inclusion category: bugfix bugzilla: NA CVE: NA ------------------------------------ All content sent from the PF to the VF needs to be initialized or assigned a value. Otherwise, the content is a random value, which may cause information leakage. This is the case of msg_data[1] in hclge_get_link_mode(), which causes information leakage. Signed-off-by: Yufeng Mo <moyufeng@huawei.com> Reviewed-by: Peng Li <lipeng321@huawei.com> Reviewed-by: Weiwei Deng <dengweiwei@huawei.com> Reviewed-by: Zhaohui Zhong <zhongzhaohui@huawei.com> Reviewed-by: Junxin Chen <chenjunxin1@huawei.com> Signed-off-by: Shengzui You <youshengzui@huawei.com> Signed-off-by: Yang Yingliang <yangyingliang@huawei.com> --- drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_mbx.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_mbx.c b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_mbx.c index e04469cfb0b48..2f5dae517df99 100644 --- a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_mbx.c +++ b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_mbx.c @@ -595,6 +595,7 @@ static void hclge_get_link_mode(struct hclge_vport *vport, u8 msg_data[10]; u8 dest_vfid; + memset(msg_data, 0, sizeof(msg_data)); advertising = hdev->hw.mac.advertising[0]; supported = hdev->hw.mac.supported[0]; dest_vfid = mbx_req->mbx_src_vfid; -- 2.25.1
From: Shengzui You <youshengzui@huawei.com> driver inclusion category: bugfix bugzilla: NA CVE: NA ----------------------------- This patch is used to update driver version to 1.9.38.7. Signed-off-by: Shengzui You <youshengzui@huawei.com> Reviewed-by: Weiwei Deng <dengweiwei@huawei.com> Reviewed-by: Zhaohui Zhong <zhongzhaohui@huawei.com> Reviewed-by: Junxin Chen <chenjunxin1@huawei.com> Signed-off-by: Yang Yingliang <yangyingliang@huawei.com> --- drivers/net/ethernet/hisilicon/hns3/hnae3.h | 2 +- drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_version.h | 2 +- drivers/net/ethernet/hisilicon/hns3/hns3_enet.h | 2 +- drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.h | 2 +- drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_main.h | 2 +- 5 files changed, 5 insertions(+), 5 deletions(-) diff --git a/drivers/net/ethernet/hisilicon/hns3/hnae3.h b/drivers/net/ethernet/hisilicon/hns3/hnae3.h index cb2e6334e5d75..6514d4ba21831 100644 --- a/drivers/net/ethernet/hisilicon/hns3/hnae3.h +++ b/drivers/net/ethernet/hisilicon/hns3/hnae3.h @@ -30,7 +30,7 @@ #include <linux/pci.h> #include <linux/types.h> -#define HNAE3_MOD_VERSION "1.9.38.6" +#define HNAE3_MOD_VERSION "1.9.38.7" #define HNAE3_MIN_VECTOR_NUM 2 /* first one for misc, another for IO */ diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_version.h b/drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_version.h index fa14f75702d1a..83c68e80fff69 100644 --- a/drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_version.h +++ b/drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_version.h @@ -4,7 +4,7 @@ #ifndef __HNS3_CAE_VERSION_H__ #define __HNS3_CAE_VERSION_H__ -#define HNS3_CAE_MOD_VERSION "1.9.38.6" +#define HNS3_CAE_MOD_VERSION "1.9.38.7" #define CMT_ID_LEN 8 #define RESV_LEN 3 diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3_enet.h b/drivers/net/ethernet/hisilicon/hns3/hns3_enet.h index d05a7e0c4cad2..14052304b90ce 100644 --- a/drivers/net/ethernet/hisilicon/hns3/hns3_enet.h +++ b/drivers/net/ethernet/hisilicon/hns3/hns3_enet.h @@ -8,7 +8,7 @@ #include "hnae3.h" -#define HNS3_MOD_VERSION "1.9.38.6" +#define HNS3_MOD_VERSION "1.9.38.7" extern char hns3_driver_version[]; diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.h b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.h index 6bd9c215af9a3..e18b08d788495 100644 --- a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.h +++ b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.h @@ -12,7 +12,7 @@ #include "hclge_cmd.h" #include "hnae3.h" -#define HCLGE_MOD_VERSION "1.9.38.6" +#define HCLGE_MOD_VERSION "1.9.38.7" #define HCLGE_DRIVER_NAME "hclge" #define HCLGE_MAX_PF_NUM 8 diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_main.h b/drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_main.h index b91ff73c503b9..afff1ca1988e0 100644 --- a/drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_main.h +++ b/drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_main.h @@ -10,7 +10,7 @@ #include "hclgevf_cmd.h" #include "hnae3.h" -#define HCLGEVF_MOD_VERSION "1.9.38.6" +#define HCLGEVF_MOD_VERSION "1.9.38.7" #define HCLGEVF_DRIVER_NAME "hclgevf" #define HCLGEVF_MAX_VLAN_ID 4095 -- 2.25.1
participants (1)
-
Yang Yingliang