From 37b07be28a3fcdde2724cc467bdb3c82bf35deef Mon Sep 17 00:00:00 2001 From: Hyong Youb Kim Date: Mon, 8 Apr 2019 23:40:26 -0700 Subject: [PATCH] net/enic: fix raw item length check Currently, the raw item is always preceded by a UDP header, and both land in the L4 pattern buffer. So consider the UDP header size when checking if the raw spec fits in the L4 buffer. Coverity issue: 336796, 336850 Fixes: 477959e6eeb0 ("net/enic: enable limited support for raw flow item") Signed-off-by: Hyong Youb Kim Reviewed-by: John Daley --- drivers/net/enic/enic_flow.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/drivers/net/enic/enic_flow.c b/drivers/net/enic/enic_flow.c index 5924a01e3c..32ebeff09f 100644 --- a/drivers/net/enic/enic_flow.c +++ b/drivers/net/enic/enic_flow.c @@ -967,7 +967,8 @@ enic_copy_item_raw_v2(struct copy_item_args *arg) if (!spec->relative || spec->offset != 0 || spec->search || spec->limit) return EINVAL; /* Need non-null pattern that fits within the NIC's filter pattern */ - if (spec->length == 0 || spec->length > FILTER_GENERIC_1_KEY_LEN || + if (spec->length == 0 || + spec->length + sizeof(struct udp_hdr) > FILTER_GENERIC_1_KEY_LEN || !spec->pattern || !mask->pattern) return EINVAL; /* -- 2.20.1