Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit c9a6ce50 authored by Divy Le Ray's avatar Divy Le Ray Committed by David S. Miller
Browse files

cxgb3 - tighten checks on TID values 



Enforce validity checks on connection ids

Signed-off-by: default avatarDivy Le Ray <divy@chelsio.com>
Signed-off-by: default avatarJeff Garzik <jeff@garzik.org>
parent e22bb45d

drivers/net/cxgb3/cxgb3_defs.h

+18 −2
Original line number Diff line number Diff line
@@ -79,9 +79,17 @@ static inline struct t3c_tid_entry *lookup_tid(const struct tid_info *t, 
static inline struct t3c_tid_entry *lookup_stid(const struct tid_info *t,

						unsigned int tid)

{

	union listen_entry *e;



	if (tid < t->stid_base || tid >= t->stid_base + t->nstids)

		return NULL;

	return &(stid2entry(t, tid)->t3c_tid);



	e = stid2entry(t, tid);

	if ((void *)e->next >= (void *)t->tid_tab &&

	    (void *)e->next < (void *)&t->atid_tab[t->natids])

		return NULL;



	return &e->t3c_tid;

}



/*
@@ -90,9 +98,17 @@ static inline struct t3c_tid_entry *lookup_stid(const struct tid_info *t, 
static inline struct t3c_tid_entry *lookup_atid(const struct tid_info *t,

						unsigned int tid)

{

	union active_open_entry *e;



	if (tid < t->atid_base || tid >= t->atid_base + t->natids)

		return NULL;

	return &(atid2entry(t, tid)->t3c_tid);



	e = atid2entry(t, tid);

	if ((void *)e->next >= (void *)t->tid_tab &&

	    (void *)e->next < (void *)&t->atid_tab[t->natids])

		return NULL;



	return &e->t3c_tid;

}



int process_rx(struct t3cdev *dev, struct sk_buff **skbs, int n);

drivers/net/cxgb3/cxgb3_offload.c

+23 −5
Original line number Diff line number Diff line
@@ -57,7 +57,7 @@ static DEFINE_RWLOCK(adapter_list_lock); 
static LIST_HEAD(adapter_list);



static const unsigned int MAX_ATIDS = 64 * 1024;

static const unsigned int ATID_BASE = 0x100000;

static const unsigned int ATID_BASE = 0x10000;



static inline int offload_activated(struct t3cdev *tdev)

{
@@ -694,10 +694,19 @@ static int do_cr(struct t3cdev *dev, struct sk_buff *skb) 
{

	struct cpl_pass_accept_req *req = cplhdr(skb);

	unsigned int stid = G_PASS_OPEN_TID(ntohl(req->tos_tid));

	struct tid_info *t = &(T3C_DATA(dev))->tid_maps;

	struct t3c_tid_entry *t3c_tid;

	unsigned int tid = GET_TID(req);



	t3c_tid = lookup_stid(&(T3C_DATA(dev))->tid_maps, stid);

	if (t3c_tid->ctx && t3c_tid->client->handlers &&

	if (unlikely(tid >= t->ntids)) {

		printk("%s: passive open TID %u too large\n",

		       dev->name, tid);

		t3_fatal_err(tdev2adap(dev));

		return CPL_RET_BUF_DONE;

	}



	t3c_tid = lookup_stid(t, stid);

	if (t3c_tid && t3c_tid->ctx && t3c_tid->client->handlers &&

	    t3c_tid->client->handlers[CPL_PASS_ACCEPT_REQ]) {

		return t3c_tid->client->handlers[CPL_PASS_ACCEPT_REQ]

		    (dev, skb, t3c_tid->ctx);
@@ -779,16 +788,25 @@ static int do_act_establish(struct t3cdev *dev, struct sk_buff *skb) 
{

	struct cpl_act_establish *req = cplhdr(skb);

	unsigned int atid = G_PASS_OPEN_TID(ntohl(req->tos_tid));

	struct tid_info *t = &(T3C_DATA(dev))->tid_maps;

	struct t3c_tid_entry *t3c_tid;

	unsigned int tid = GET_TID(req);



	t3c_tid = lookup_atid(&(T3C_DATA(dev))->tid_maps, atid);

	if (unlikely(tid >= t->ntids)) {

		printk("%s: active establish TID %u too large\n",

		       dev->name, tid);

		t3_fatal_err(tdev2adap(dev));

		return CPL_RET_BUF_DONE;

	}



	t3c_tid = lookup_atid(t, atid);

	if (t3c_tid && t3c_tid->ctx && t3c_tid->client->handlers &&

	    t3c_tid->client->handlers[CPL_ACT_ESTABLISH]) {

		return t3c_tid->client->handlers[CPL_ACT_ESTABLISH]

		    (dev, skb, t3c_tid->ctx);

	} else {

		printk(KERN_ERR "%s: received clientless CPL command 0x%x\n",

		       dev->name, CPL_PASS_ACCEPT_REQ);

		       dev->name, CPL_ACT_ESTABLISH);

		return CPL_RET_BUF_DONE | CPL_RET_BAD_MSG;

	}

}