Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit c700f4e6 authored by Emil Tantilov's avatar Emil Tantilov Committed by Jeff Kirsher
Browse files

ixgbe: Bounds checking for set_rar, clear_rar, set_vmdq, clear_vmdq 



This change makes it so that out of bounds requests to these calls will
now return IXGBE_ERR_INVALID_ARGUMENT instead of returning 0.

Signed-off-by: default avatarEmil Tantilov <emil.s.tantilov@intel.com>
Tested-by: default avatarStephen Ko <stephen.s.ko@intel.com>
Signed-off-by: default avatarJeff Kirsher <jeffrey.t.kirsher@intel.com>
parent 26d6899b

drivers/net/ixgbe/ixgbe_82598.c

+17 −7
Original line number Diff line number Diff line
@@ -858,6 +858,13 @@ static s32 ixgbe_reset_hw_82598(struct ixgbe_hw *hw) 
static s32 ixgbe_set_vmdq_82598(struct ixgbe_hw *hw, u32 rar, u32 vmdq)

{

	u32 rar_high;

	u32 rar_entries = hw->mac.num_rar_entries;



	/* Make sure we are using a valid rar index range */

	if (rar >= rar_entries) {

		hw_dbg(hw, "RAR index %d is out of range.\n", rar);

		return IXGBE_ERR_INVALID_ARGUMENT;

	}



	rar_high = IXGBE_READ_REG(hw, IXGBE_RAH(rar));

	rar_high &= ~IXGBE_RAH_VIND_MASK;
@@ -877,15 +884,18 @@ static s32 ixgbe_clear_vmdq_82598(struct ixgbe_hw *hw, u32 rar, u32 vmdq) 
	u32 rar_high;

	u32 rar_entries = hw->mac.num_rar_entries;



	if (rar < rar_entries) {



	/* Make sure we are using a valid rar index range */

	if (rar >= rar_entries) {

		hw_dbg(hw, "RAR index %d is out of range.\n", rar);

		return IXGBE_ERR_INVALID_ARGUMENT;

	}



	rar_high = IXGBE_READ_REG(hw, IXGBE_RAH(rar));

	if (rar_high & IXGBE_RAH_VIND_MASK) {

		rar_high &= ~IXGBE_RAH_VIND_MASK;

		IXGBE_WRITE_REG(hw, IXGBE_RAH(rar), rar_high);

	}

	} else {

		hw_dbg(hw, "RAR index %d is out of range.\n", rar);

	}



	return 0;

}

drivers/net/ixgbe/ixgbe_common.c

+78 −75
Original line number Diff line number Diff line
@@ -1239,11 +1239,15 @@ s32 ixgbe_set_rar_generic(struct ixgbe_hw *hw, u32 index, u8 *addr, u32 vmdq, 
	u32 rar_low, rar_high;

	u32 rar_entries = hw->mac.num_rar_entries;



	/* Make sure we are using a valid rar index range */

	if (index >= rar_entries) {

		hw_dbg(hw, "RAR index %d is out of range.\n", index);

		return IXGBE_ERR_INVALID_ARGUMENT;

	}



	/* setup VMDq pool selection before this RAR gets enabled */

	hw->mac.ops.set_vmdq(hw, index, vmdq);



	/* Make sure we are using a valid rar index range */

	if (index < rar_entries) {

	/*

	 * HW expects these in little endian so we reverse the byte

	 * order from network order (big endian) to little endian
@@ -1266,10 +1270,6 @@ s32 ixgbe_set_rar_generic(struct ixgbe_hw *hw, u32 index, u8 *addr, u32 vmdq, 


	IXGBE_WRITE_REG(hw, IXGBE_RAL(index), rar_low);

	IXGBE_WRITE_REG(hw, IXGBE_RAH(index), rar_high);

	} else {

		hw_dbg(hw, "RAR index %d is out of range.\n", index);

		return IXGBE_ERR_RAR_INDEX;

	}



	return 0;

}
@@ -1287,7 +1287,11 @@ s32 ixgbe_clear_rar_generic(struct ixgbe_hw *hw, u32 index) 
	u32 rar_entries = hw->mac.num_rar_entries;



	/* Make sure we are using a valid rar index range */

	if (index < rar_entries) {

	if (index >= rar_entries) {

		hw_dbg(hw, "RAR index %d is out of range.\n", index);

		return IXGBE_ERR_INVALID_ARGUMENT;

	}



	/*

	 * Some parts put the VMDq setting in the extra RAH bits,

	 * so save everything except the lower 16 bits that hold part
@@ -1298,10 +1302,6 @@ s32 ixgbe_clear_rar_generic(struct ixgbe_hw *hw, u32 index) 


	IXGBE_WRITE_REG(hw, IXGBE_RAL(index), 0);

	IXGBE_WRITE_REG(hw, IXGBE_RAH(index), rar_high);

	} else {

		hw_dbg(hw, "RAR index %d is out of range.\n", index);

		return IXGBE_ERR_RAR_INDEX;

	}



	/* clear VMDq pool/queue selection for this RAR */

	hw->mac.ops.clear_vmdq(hw, index, IXGBE_CLEAR_VMDQ_ALL);
@@ -2468,7 +2468,12 @@ s32 ixgbe_clear_vmdq_generic(struct ixgbe_hw *hw, u32 rar, u32 vmdq) 
	u32 mpsar_lo, mpsar_hi;

	u32 rar_entries = hw->mac.num_rar_entries;



	if (rar < rar_entries) {

	/* Make sure we are using a valid rar index range */

	if (rar >= rar_entries) {

		hw_dbg(hw, "RAR index %d is out of range.\n", rar);

		return IXGBE_ERR_INVALID_ARGUMENT;

	}



	mpsar_lo = IXGBE_READ_REG(hw, IXGBE_MPSAR_LO(rar));

	mpsar_hi = IXGBE_READ_REG(hw, IXGBE_MPSAR_HI(rar));
@@ -2495,10 +2500,6 @@ s32 ixgbe_clear_vmdq_generic(struct ixgbe_hw *hw, u32 rar, u32 vmdq) 
	/* was that the last pool using this rar? */

	if (mpsar_lo == 0 && mpsar_hi == 0 && rar != 0)

		hw->mac.ops.clear_rar(hw, rar);

	} else {

		hw_dbg(hw, "RAR index %d is out of range.\n", rar);

	}



done:

	return 0;

}
@@ -2514,7 +2515,12 @@ s32 ixgbe_set_vmdq_generic(struct ixgbe_hw *hw, u32 rar, u32 vmdq) 
	u32 mpsar;

	u32 rar_entries = hw->mac.num_rar_entries;



	if (rar < rar_entries) {

	/* Make sure we are using a valid rar index range */

	if (rar >= rar_entries) {

		hw_dbg(hw, "RAR index %d is out of range.\n", rar);

		return IXGBE_ERR_INVALID_ARGUMENT;

	}



	if (vmdq < 32) {

		mpsar = IXGBE_READ_REG(hw, IXGBE_MPSAR_LO(rar));

		mpsar |= 1 << vmdq;
@@ -2524,9 +2530,6 @@ s32 ixgbe_set_vmdq_generic(struct ixgbe_hw *hw, u32 rar, u32 vmdq) 
		mpsar |= 1 << (vmdq - 32);

		IXGBE_WRITE_REG(hw, IXGBE_MPSAR_HI(rar), mpsar);

	}

	} else {

		hw_dbg(hw, "RAR index %d is out of range.\n", rar);

	}

	return 0;

}

drivers/net/ixgbe/ixgbe_type.h

+0 −1
Original line number Diff line number Diff line
@@ -2689,7 +2689,6 @@ struct ixgbe_info { 
#define IXGBE_ERR_EEPROM_VERSION                -24

#define IXGBE_ERR_NO_SPACE                      -25

#define IXGBE_ERR_OVERTEMP                      -26

#define IXGBE_ERR_RAR_INDEX                     -27

#define IXGBE_ERR_SFP_SETUP_NOT_COMPLETE        -30

#define IXGBE_ERR_PBA_SECTION                   -31

#define IXGBE_ERR_INVALID_ARGUMENT              -32