Commit 26aeb9da authored May 08, 2018 by Jakub Kicinski Committed by Daniel Borkmann May 09, 2018

nfp: bpf: allow zero-length capabilities



Some BPF capabilities carry no value, they simply indicate feature
is present.  Our capability parsing loop will exit early if last
capability is zero-length because it's looking for more than 8 bytes
of data (8B is our TLV header length).  Allow the last capability to
be zero-length.

This bug would lead to driver failing to probe with the following error
if the last capability FW advertises is zero-length:

    nfp: BPF capabilities left after parsing, parsed:92 total length:100
    nfp: invalid BPF capabilities at offset:92

Note the "parsed" and "length" values are 8 apart.

No shipping FW runs into this issue, but we can't guarantee that will
remain the case.

Fixes: 77a844ee ("nfp: bpf: prepare for parsing BPF FW capabilities")
Signed-off-by: Jakub Kicinski <jakub.kicinski@netronome.com>
Reviewed-by: Quentin Monnet <quentin.monnet@netronome.com>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>

parent 3148dedf

drivers/net/ethernet/netronome/nfp/bpf/main.c

+1 −1

Original line number	Diff line number	Diff line
		@@ -335,7 +335,7 @@ static int nfp_bpf_parse_capabilities(struct nfp_app *app)
		return PTR_ERR(mem) == -ENOENT ? 0 : PTR_ERR(mem);

		start = mem;
		while (mem - start + 8 < nfp_cpp_area_size(area)) {
		while (mem - start + 8 <= nfp_cpp_area_size(area)) {
		u8 __iomem *value;
		u32 type, length;