Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 5692dbb5 authored by Simon Horman's avatar Simon Horman Committed by David S. Miller
Browse files

nfp: prevent theoretical buffer overrun in nfp_eth_read_ports 



Prevent theoretical buffer overrun by returning an error if
the number of entries returned by the firmware does not match those
present.

Also use a common handling error path.

Found by inspection.

Signed-off-by: default avatarSimon Horman <simon.horman@netronome.com>
Tested-by: default avatarJakub Kicinski <jakub.kicinski@netronome.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent b9dcf88a

drivers/net/ethernet/netronome/nfp/nfpcore/nfp_nsp_eth.c

+20 −14
Original line number Diff line number Diff line
@@ -191,8 +191,7 @@ __nfp_eth_read_ports(struct nfp_cpp *cpp, struct nfp_nsp *nsp) 
{

	struct eth_table_entry *entries;

	struct nfp_eth_table *table;

	unsigned int cnt;

	int i, j, ret;

	int i, j, ret, cnt = 0;



	entries = kzalloc(NSP_ETH_TABLE_SIZE, GFP_KERNEL);

	if (!entries)
@@ -201,24 +200,27 @@ __nfp_eth_read_ports(struct nfp_cpp *cpp, struct nfp_nsp *nsp) 
	ret = nfp_nsp_read_eth_table(nsp, entries, NSP_ETH_TABLE_SIZE);

	if (ret < 0) {

		nfp_err(cpp, "reading port table failed %d\n", ret);

		kfree(entries);

		return NULL;

		goto err;

	}



	/* Some versions of flash will give us 0 instead of port count */

	cnt = ret;

	if (!cnt) {

	for (i = 0; i < NSP_ETH_MAX_COUNT; i++)

		if (entries[i].port & NSP_ETH_PORT_LANES_MASK)

			cnt++;



	/* Some versions of flash will give us 0 instead of port count.

	 * For those that give a port count, verify it against the value

	 * calculated above.

	 */

	if (ret && ret != cnt) {

		nfp_err(cpp, "table entry count reported (%d) does not match entries present (%d)\n",

			ret, cnt);

		goto err;

	}



	table = kzalloc(sizeof(*table) +

			sizeof(struct nfp_eth_table_port) * cnt, GFP_KERNEL);

	if (!table) {

		kfree(entries);

		return NULL;

	}

	if (!table)

		goto err;



	table->count = cnt;

	for (i = 0, j = 0; i < NSP_ETH_MAX_COUNT; i++)
@@ -231,6 +233,10 @@ __nfp_eth_read_ports(struct nfp_cpp *cpp, struct nfp_nsp *nsp) 
	kfree(entries);



	return table;



err:

	kfree(entries);

	return NULL;

}



/**