Commit e2f7d3f7 authored by Jan Glaza's avatar Jan Glaza Committed by Tony Nguyen
Browse files

ice: validate queue quanta parameters to prevent OOB access 



Add queue wraparound prevention in quanta configuration.
Ensure end_qid does not overflow by validating start_qid and num_queues.

Fixes: 01530775 ("ice: Support VF queue rate limit and quanta size configuration")
Reviewed-by: default avatarJedrzej Jagielski <jedrzej.jagielski@intel.com>
Reviewed-by: default avatarSimon Horman <horms@kernel.org>
Signed-off-by: default avatarJan Glaza <jan.glaza@intel.com>
Signed-off-by: default avatarMartyna Szapar-Mudlaw <martyna.szapar-mudlaw@linux.intel.com>
Tested-by: default avatarRafal Romanowski <rafal.romanowski@intel.com>
Signed-off-by: default avatarTony Nguyen <anthony.l.nguyen@intel.com>
parent f91d0efc

drivers/net/ethernet/intel/ice/ice_virtchnl.c

+9 −4
Original line number Diff line number Diff line
@@ -1900,13 +1900,21 @@ static int ice_vc_cfg_q_bw(struct ice_vf *vf, u8 *msg) 
 */

static int ice_vc_cfg_q_quanta(struct ice_vf *vf, u8 *msg)

{

	u16 quanta_prof_id, quanta_size, start_qid, num_queues, end_qid, i;

	enum virtchnl_status_code v_ret = VIRTCHNL_STATUS_SUCCESS;

	u16 quanta_prof_id, quanta_size, start_qid, end_qid, i;

	struct virtchnl_quanta_cfg *qquanta =

		(struct virtchnl_quanta_cfg *)msg;

	struct ice_vsi *vsi;

	int ret;



	start_qid = qquanta->queue_select.start_queue_id;

	num_queues = qquanta->queue_select.num_queues;



	if (check_add_overflow(start_qid, num_queues, &end_qid)) {

		v_ret = VIRTCHNL_STATUS_ERR_PARAM;

		goto err;

	}



	if (!test_bit(ICE_VF_STATE_ACTIVE, vf->vf_states)) {

		v_ret = VIRTCHNL_STATUS_ERR_PARAM;

		goto err;
@@ -1918,8 +1926,6 @@ static int ice_vc_cfg_q_quanta(struct ice_vf *vf, u8 *msg) 
		goto err;

	}



	end_qid = qquanta->queue_select.start_queue_id +

		  qquanta->queue_select.num_queues;

	if (end_qid > ICE_MAX_RSS_QS_PER_VF ||

	    end_qid > min_t(u16, vsi->alloc_txq, vsi->alloc_rxq)) {

		dev_err(ice_pf_to_dev(vf->pf), "VF-%d trying to configure more than allocated number of queues: %d\n",
@@ -1948,7 +1954,6 @@ static int ice_vc_cfg_q_quanta(struct ice_vf *vf, u8 *msg) 
		goto err;

	}



	start_qid = qquanta->queue_select.start_queue_id;

	for (i = start_qid; i < end_qid; i++)

		vsi->tx_rings[i]->quanta_prof_id = quanta_prof_id;