From patchwork Fri Sep 25 12:48:38 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Greg KH X-Patchwork-Id: 263480 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-10.9 required=3.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED, DKIM_VALID, HEADER_FROM_DIFFERENT_DOMAINS, MAILING_LIST_MULTI, SIGNED_OFF_BY,SPF_HELO_NONE,SPF_PASS,URIBL_BLOCKED,USER_AGENT_GIT autolearn=unavailable autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 44C26C4741F for ; Fri, 25 Sep 2020 12:55:34 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 080AE2075E for ; Fri, 25 Sep 2020 12:55:34 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1601038534; bh=oCEO3l2SqYTgG5TOA0nDptZZvjG6lrB864tuU+mM7Ss=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-ID:From; b=UXeglDpu80GRMWmwbaY4LZvlHZW0QNC1nDv5ZCRRQt7pDvzuk6S+AcEcSynOJI2Zj LoERdNDQU5mix/Cfrph1qxA1wIjSLGCFtRg50BI9gohQQ6+NciUyy7TV0Kl0GaBkQQ J0Ha30MbTcU7vP3/IHmMxsf0WAdJa21aHh1udjRs= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1729623AbgIYMyy (ORCPT ); Fri, 25 Sep 2020 08:54:54 -0400 Received: from mail.kernel.org ([198.145.29.99]:33996 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1729616AbgIYMyw (ORCPT ); Fri, 25 Sep 2020 08:54:52 -0400 Received: from localhost (83-86-74-64.cable.dynamic.v4.ziggo.nl [83.86.74.64]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id D2DF3206DB; Fri, 25 Sep 2020 12:54:51 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1601038492; bh=oCEO3l2SqYTgG5TOA0nDptZZvjG6lrB864tuU+mM7Ss=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=kT1hJ9B90MkA0kqQfUGcNJWsS1h1/d9HHcTQC2RdAoYOACg2YU5PTMIayeQZ2G+yg SHURK4XBF3vH7fRyVXYO9KqpF6M3FYf0sH1PQFKCd2vWJeQ1eEiVQRTvLVuLMkefDG uOAWTxgvEH03PUdCPHZAPEjNxggVqkBvxTCd1lHk= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Parav Pandit , Saeed Mahameed , Petr Machata , Ido Schimmel , Jiri Pirko , "David S. Miller" Subject: [PATCH 4.19 10/37] net: DCB: Validate DCB_ATTR_DCB_BUFFER argument Date: Fri, 25 Sep 2020 14:48:38 +0200 Message-Id: <20200925124722.503844295@linuxfoundation.org> X-Mailer: git-send-email 2.28.0 In-Reply-To: <20200925124720.972208530@linuxfoundation.org> References: <20200925124720.972208530@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Petr Machata [ Upstream commit 297e77e53eadb332d5062913447b104a772dc33b ] The parameter passed via DCB_ATTR_DCB_BUFFER is a struct dcbnl_buffer. The field prio2buffer is an array of IEEE_8021Q_MAX_PRIORITIES bytes, where each value is a number of a buffer to direct that priority's traffic to. That value is however never validated to lie within the bounds set by DCBX_MAX_BUFFERS. The only driver that currently implements the callback is mlx5 (maintainers CCd), and that does not do any validation either, in particual allowing incorrect configuration if the prio2buffer value does not fit into 4 bits. Instead of offloading the need to validate the buffer index to drivers, do it right there in core, and bounce the request if the value is too large. CC: Parav Pandit CC: Saeed Mahameed Fixes: e549f6f9c098 ("net/dcb: Add dcbnl buffer attribute") Signed-off-by: Petr Machata Reviewed-by: Ido Schimmel Reviewed-by: Jiri Pirko Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman --- net/dcb/dcbnl.c | 8 ++++++++ 1 file changed, 8 insertions(+) --- a/net/dcb/dcbnl.c +++ b/net/dcb/dcbnl.c @@ -1421,6 +1421,7 @@ static int dcbnl_ieee_set(struct net_dev { const struct dcbnl_rtnl_ops *ops = netdev->dcbnl_ops; struct nlattr *ieee[DCB_ATTR_IEEE_MAX + 1]; + int prio; int err; if (!ops) @@ -1469,6 +1470,13 @@ static int dcbnl_ieee_set(struct net_dev struct dcbnl_buffer *buffer = nla_data(ieee[DCB_ATTR_DCB_BUFFER]); + for (prio = 0; prio < ARRAY_SIZE(buffer->prio2buffer); prio++) { + if (buffer->prio2buffer[prio] >= DCBX_MAX_BUFFERS) { + err = -EINVAL; + goto err; + } + } + err = ops->dcbnl_setbuffer(netdev, buffer); if (err) goto err;