From c4ea98c42da7d2e4f990d2cca291f6415b57ed9f Mon Sep 17 00:00:00 2001 From: Ivan Malov Date: Mon, 10 Sep 2018 10:33:31 +0100 Subject: [PATCH] net/sfc/base: check buffer size for hash flags The efx_rx_scale_hash_flags_get interface is unsafe, as it does not have an argument for the size of the output buffer used to return the flags. While the only caller currently supplies a sufficiently large buffer, this should be checked at runtime to avoid writing past the end of the buffer. Signed-off-by: Ivan Malov Signed-off-by: Andrew Rybchenko --- drivers/net/sfc/base/efx.h | 3 +- drivers/net/sfc/base/efx_annote.h | 1 + drivers/net/sfc/base/efx_rx.c | 120 +++++++++++++++++++----------- drivers/net/sfc/sfc_rx.c | 2 +- 4 files changed, 81 insertions(+), 45 deletions(-) diff --git a/drivers/net/sfc/base/efx.h b/drivers/net/sfc/base/efx.h index cc68f744ed..de62b7d504 100644 --- a/drivers/net/sfc/base/efx.h +++ b/drivers/net/sfc/base/efx.h @@ -2368,7 +2368,8 @@ extern __checkReturn efx_rc_t efx_rx_scale_hash_flags_get( __in efx_nic_t *enp, __in efx_rx_hash_alg_t hash_alg, - __inout_ecount(EFX_RX_HASH_NFLAGS) unsigned int *flagsp, + __out_ecount_part(max_nflags, *nflagsp) unsigned int *flagsp, + __in unsigned int max_nflags, __out unsigned int *nflagsp); extern __checkReturn efx_rc_t diff --git a/drivers/net/sfc/base/efx_annote.h b/drivers/net/sfc/base/efx_annote.h index 671aaed3b6..607b43c770 100644 --- a/drivers/net/sfc/base/efx_annote.h +++ b/drivers/net/sfc/base/efx_annote.h @@ -33,6 +33,7 @@ #define __out_opt #define __out_ecount(_n) #define __out_ecount_opt(_n) +#define __out_ecount_part(_n, _l) #define __out_bcount(_n) #define __out_bcount_opt(_n) #define __out_bcount_part(_n, _l) diff --git a/drivers/net/sfc/base/efx_rx.c b/drivers/net/sfc/base/efx_rx.c index dfd3974da8..bb0c144d72 100644 --- a/drivers/net/sfc/base/efx_rx.c +++ b/drivers/net/sfc/base/efx_rx.c @@ -298,13 +298,12 @@ fail1: efx_rx_scale_hash_flags_get( __in efx_nic_t *enp, __in efx_rx_hash_alg_t hash_alg, - __inout_ecount(EFX_RX_HASH_NFLAGS) unsigned int *flagsp, + __out_ecount_part(max_nflags, *nflagsp) unsigned int *flagsp, + __in unsigned int max_nflags, __out unsigned int *nflagsp) { efx_nic_cfg_t *encp = &enp->en_nic_cfg; - boolean_t l4; - boolean_t additional_modes; - unsigned int *entryp = flagsp; + unsigned int nflags = 0; efx_rc_t rc; if (flagsp == NULL || nflagsp == NULL) { @@ -313,56 +312,90 @@ efx_rx_scale_hash_flags_get( } if ((encp->enc_rx_scale_hash_alg_mask & (1U << hash_alg)) == 0) { - *nflagsp = 0; - return 0; + nflags = 0; + goto done; } - l4 = encp->enc_rx_scale_l4_hash_supported; - additional_modes = encp->enc_rx_scale_additional_modes_supported; - -#define LIST_FLAGS(_entryp, _class, _l4_hashing, _additional_modes) \ - do { \ - if (_l4_hashing) { \ - *(_entryp++) = EFX_RX_HASH(_class, 4TUPLE); \ - \ - if (_additional_modes) { \ - *(_entryp++) = \ - EFX_RX_HASH(_class, 2TUPLE_DST); \ - *(_entryp++) = \ - EFX_RX_HASH(_class, 2TUPLE_SRC); \ - } \ - } \ - \ - *(_entryp++) = EFX_RX_HASH(_class, 2TUPLE); \ - \ - if (_additional_modes) { \ - *(_entryp++) = EFX_RX_HASH(_class, 1TUPLE_DST); \ - *(_entryp++) = EFX_RX_HASH(_class, 1TUPLE_SRC); \ - } \ - \ - *(_entryp++) = EFX_RX_HASH(_class, DISABLE); \ - \ - _NOTE(CONSTANTCONDITION) \ + /* Helper to add flags word to flags array without buffer overflow */ +#define INSERT_FLAGS(_flags) \ + do { \ + if (nflags >= max_nflags) { \ + rc = E2BIG; \ + goto fail2; \ + } \ + *(flagsp + nflags) = (_flags); \ + nflags++; \ + \ + _NOTE(CONSTANTCONDITION) \ } while (B_FALSE) - LIST_FLAGS(entryp, IPV4_TCP, l4, additional_modes); - LIST_FLAGS(entryp, IPV6_TCP, l4, additional_modes); + if (encp->enc_rx_scale_l4_hash_supported != B_FALSE) { + INSERT_FLAGS(EFX_RX_HASH(IPV4_TCP, 4TUPLE)); + INSERT_FLAGS(EFX_RX_HASH(IPV6_TCP, 4TUPLE)); + } + + if ((encp->enc_rx_scale_l4_hash_supported != B_FALSE) && + (encp->enc_rx_scale_additional_modes_supported != B_FALSE)) { + INSERT_FLAGS(EFX_RX_HASH(IPV4_TCP, 2TUPLE_DST)); + INSERT_FLAGS(EFX_RX_HASH(IPV4_TCP, 2TUPLE_SRC)); + + INSERT_FLAGS(EFX_RX_HASH(IPV6_TCP, 2TUPLE_DST)); + INSERT_FLAGS(EFX_RX_HASH(IPV6_TCP, 2TUPLE_SRC)); - if (additional_modes) { - LIST_FLAGS(entryp, IPV4_UDP, l4, additional_modes); - LIST_FLAGS(entryp, IPV6_UDP, l4, additional_modes); + INSERT_FLAGS(EFX_RX_HASH(IPV4_UDP, 4TUPLE)); + INSERT_FLAGS(EFX_RX_HASH(IPV4_UDP, 2TUPLE_DST)); + INSERT_FLAGS(EFX_RX_HASH(IPV4_UDP, 2TUPLE_SRC)); + + INSERT_FLAGS(EFX_RX_HASH(IPV6_UDP, 4TUPLE)); + INSERT_FLAGS(EFX_RX_HASH(IPV6_UDP, 2TUPLE_DST)); + INSERT_FLAGS(EFX_RX_HASH(IPV6_UDP, 2TUPLE_SRC)); + } + + INSERT_FLAGS(EFX_RX_HASH(IPV4_TCP, 2TUPLE)); + INSERT_FLAGS(EFX_RX_HASH(IPV6_TCP, 2TUPLE)); + + INSERT_FLAGS(EFX_RX_HASH(IPV4, 2TUPLE)); + INSERT_FLAGS(EFX_RX_HASH(IPV6, 2TUPLE)); + + if (encp->enc_rx_scale_additional_modes_supported != B_FALSE) { + INSERT_FLAGS(EFX_RX_HASH(IPV4_TCP, 1TUPLE_DST)); + INSERT_FLAGS(EFX_RX_HASH(IPV4_TCP, 1TUPLE_SRC)); + + INSERT_FLAGS(EFX_RX_HASH(IPV6_TCP, 1TUPLE_DST)); + INSERT_FLAGS(EFX_RX_HASH(IPV6_TCP, 1TUPLE_SRC)); + + INSERT_FLAGS(EFX_RX_HASH(IPV4_UDP, 2TUPLE)); + INSERT_FLAGS(EFX_RX_HASH(IPV4_UDP, 1TUPLE_DST)); + INSERT_FLAGS(EFX_RX_HASH(IPV4_UDP, 1TUPLE_SRC)); + + INSERT_FLAGS(EFX_RX_HASH(IPV6_UDP, 2TUPLE)); + INSERT_FLAGS(EFX_RX_HASH(IPV6_UDP, 1TUPLE_DST)); + INSERT_FLAGS(EFX_RX_HASH(IPV6_UDP, 1TUPLE_SRC)); + + INSERT_FLAGS(EFX_RX_HASH(IPV4, 1TUPLE_DST)); + INSERT_FLAGS(EFX_RX_HASH(IPV4, 1TUPLE_SRC)); + + INSERT_FLAGS(EFX_RX_HASH(IPV6, 1TUPLE_DST)); + INSERT_FLAGS(EFX_RX_HASH(IPV6, 1TUPLE_SRC)); } - LIST_FLAGS(entryp, IPV4, B_FALSE, additional_modes); - LIST_FLAGS(entryp, IPV6, B_FALSE, additional_modes); + INSERT_FLAGS(EFX_RX_HASH(IPV4_TCP, DISABLE)); + INSERT_FLAGS(EFX_RX_HASH(IPV6_TCP, DISABLE)); + + INSERT_FLAGS(EFX_RX_HASH(IPV4_UDP, DISABLE)); + INSERT_FLAGS(EFX_RX_HASH(IPV6_UDP, DISABLE)); -#undef LIST_FLAGS + INSERT_FLAGS(EFX_RX_HASH(IPV4, DISABLE)); + INSERT_FLAGS(EFX_RX_HASH(IPV6, DISABLE)); - *nflagsp = (unsigned int)(entryp - flagsp); - EFSYS_ASSERT3U(*nflagsp, <=, EFX_RX_HASH_NFLAGS); +#undef INSERT_FLAGS +done: + *nflagsp = nflags; return (0); +fail2: + EFSYS_PROBE(fail2); fail1: EFSYS_PROBE1(fail1, efx_rc_t, rc); @@ -548,7 +581,8 @@ efx_rx_scale_mode_set( /* * Get the list of supported hash flags and sanitise the input. */ - rc = efx_rx_scale_hash_flags_get(enp, alg, type_flags, &type_nflags); + rc = efx_rx_scale_hash_flags_get(enp, alg, type_flags, + EFX_ARRAY_SIZE(type_flags), &type_nflags); if (rc != 0) goto fail2; diff --git a/drivers/net/sfc/sfc_rx.c b/drivers/net/sfc/sfc_rx.c index 2c73260a78..338184dda0 100644 --- a/drivers/net/sfc/sfc_rx.c +++ b/drivers/net/sfc/sfc_rx.c @@ -1200,7 +1200,7 @@ sfc_rx_hash_init(struct sfc_adapter *sa) return EINVAL; rc = efx_rx_scale_hash_flags_get(sa->nic, alg, flags_supp, - &nb_flags_supp); + RTE_DIM(flags_supp), &nb_flags_supp); if (rc != 0) return rc; -- 2.20.1