Skip to contentSkip to conversation

i40e: potential array underflow in i40e_vc_process_vf_msg()

PATCH Superseded Dan Carpenter 3 participants 3 messages Jan 9, 2014 – Jan 11, 2014

Subsystems (3)
Network drivers Kernel janitors Intel Ethernet

v1 of 2 Superseded Latest is v2 →

lore
Share & tools
lore

Dan Carpenter

author
#0 lore raw

PATCH 1/1 i40e: potential array underflow in i40e_vc_process_vf_msg()

If "vf_id" is smaller than hw->func_caps.vf_base_id then we leads to an array underflow of the pf->vf[] array.

Fixes 7efa84b7abc1 ('i40e: support VFs on PFs other than 0')
Signed-off-by Dan Carpenter <[email protected]>
drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c +1 -1
index 55ec2db71fa1..89482a078e9d 100644
@@ -1698,7 +1698,7 @@ int i40e_vc_process_vf_msg(struct i40e_pf *pf, u16 vf_id, u32 v_opcode,
 			   u32 v_retval, u8 *msg, u16 msglen)
 {
 	struct i40e_hw *hw = &pf->hw;
-	int local_vf_id = vf_id - hw->func_caps.vf_base_id;
+	unsigned int local_vf_id = vf_id - hw->func_caps.vf_base_id;
 	struct i40e_vf *vf;
 	int ret;
#1 lore raw
Quoted 23 lines

-----Original Message-----
From: Dan Carpenter [mailto:[email protected]]
Sent: Wednesday, January 08, 2014 9:31 PM
To: Kirsher, Jeffrey T
Cc: Brandeburg, Jesse; Allan, Bruce W; Wyborny, Carolyn; Skidmore, Donald C; Rose, Gregory V; Duyck, Alexander H; Ronciak, John; Williams, Mitch A; Nelson, Shannon; Wei Yongjun; [email protected]; kernel- [email protected]
Subject: [patch] i40e: potential array underflow in i40e_vc_process_vf_msg()

If "vf_id" is smaller than hw->func_caps.vf_base_id then we leads to an array underflow of the pf->vf[] array.

Fixes 7efa84b7abc1 ('i40e: support VFs on PFs other than 0')
Signed-off-by Dan Carpenter <[email protected]>
drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c +0 -0
index 55ec2db71fa1..89482a078e9d 100644

drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c int i40e_vc_process_vf_msg(struct i40e_pf *pf, u16 · line 1704

Quoted 8 lines
drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c +1 -1
@@ -1698,7 +1698,7 @@ int i40e_vc_process_vf_msg(struct i40e_pf *pf, u16
 vf_id, u32 v_opcode,
 			   u32 v_retval, u8 *msg, u16 msglen)
 {
 	struct i40e_hw *hw = &pf->hw;
-	int local_vf_id = vf_id - hw->func_caps.vf_base_id;
+	unsigned int local_vf_id = vf_id - hw->func_caps.vf_base_id;
 	struct i40e_vf *vf;
 	int ret;

Thanks, Dan. Aaron (covering for Jeff, who's on sabbatical) has pulled this into our internal queue for validation, and it will get pushed out with a regular update.

The patch is obviously valid, though I should point out that if this number ever turns out to be negative, there is something very, very wrong with the hardware, and we should probably all just run for cover.

-Mitch

#2 lore raw
In reply to Dan Carpenter
Quoted 40 lines

-----Original Message-----
From: Williams, Mitch A
Sent: Friday, January 10, 2014 10:50 AM
To: Dan Carpenter; Kirsher, Jeffrey T; Brown, Aaron F
Cc: Brandeburg, Jesse; Allan, Bruce W; Wyborny, Carolyn; Skidmore, Donald C; Rose, Gregory V; Duyck, Alexander H; Ronciak, John; Nelson, Shannon; Wei Yongjun; [email protected]; kernel- [email protected]
Subject: RE: [patch] i40e: potential array underflow in i40e_vc_process_vf_msg()

Quoted 27 lines

-----Original Message-----
From: Dan Carpenter [mailto:[email protected]]
Sent: Wednesday, January 08, 2014 9:31 PM
To: Kirsher, Jeffrey T
Cc: Brandeburg, Jesse; Allan, Bruce W; Wyborny, Carolyn; Skidmore, Donald C; Rose, Gregory V; Duyck, Alexander H; Ronciak, John; Williams, Mitch A; Nelson, Shannon; Wei Yongjun; [email protected]; kernel- [email protected]
Subject: [patch] i40e: potential array underflow in i40e_vc_process_vf_msg()

If "vf_id" is smaller than hw->func_caps.vf_base_id then we leads to an array underflow of the pf->vf[] array.

Fixes 7efa84b7abc1 ('i40e: support VFs on PFs other than 0')
Signed-off-by Dan Carpenter <[email protected]>
drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c +0 -1
index 55ec2db71fa1..89482a078e9d 100644
@@ -1698,7 +1698,7 @@ int i40e_vc_process_vf_msg(struct i40e_pf *pf,
 u16 vf_id, u32 v_opcode,
 			   u32 v_retval, u8 *msg, u16 msglen)  {
 	struct i40e_hw *hw = &pf->hw;
-	int local_vf_id = vf_id - hw->func_caps.vf_base_id;
Quoted 8 lines

drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c int i40e_vc_process_vf_msg(struct i40e_pf *pf, u16 vf_id, u32 v_opcode, · line 1704

Quoted 4 lines
drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c +1 -0
+	unsigned int local_vf_id = vf_id - hw->func_caps.vf_base_id;
 	struct i40e_vf *vf;
 	int ret;

Thanks, Dan. Aaron (covering for Jeff, who's on sabbatical) has pulled this into our internal queue for validation, and it will get pushed out with a regular update.

Actually, can I get you to re spin the patch based off a fresh pull from net-next? There has been a whole lot of movement in the i40e code the last couple of days and this patch no longer applies cleanly. It is straight forward enough that I could fix it up to make it apply to our internal tree, but would rather be able to send it on in as pure a form from you as possible.

Thanks,
Aaron

Quoted 6 lines

The patch is obviously valid, though I should point out that if this number ever turns out to be negative, there is something very, very wrong with the hardware, and we should probably all just run for cover.

-Mitch