[SRU v2][Trusty] ixgbe: check for vfs outside of sriov_num_vfs before dereference
Heitor R. Alves de Siqueira
halves at canonical.com
Tue Feb 12 12:54:42 UTC 2019
From: Emil Tantilov <emil.s.tantilov at intel.com>
BugLink: https://launchpad.net/bugs/1815501
The check for vfinfo is not sufficient because it does not protect
against specifying vf that is outside of sriov_num_vfs range.
All of the ndo functions have a check for it except for
ixgbevf_ndo_set_spoofcheck().
The following patch is all we need to protect against this panic:
ip link set p96p1 vf 0 spoofchk off
BUG: unable to handle kernel NULL pointer dereference at 0000000000000052
IP: [<ffffffffa044a1c1>]
ixgbe_ndo_set_vf_spoofchk+0x51/0x150 [ixgbe]
Reported-by: Thierry Herbelot <thierry.herbelot at 6wind.com>
Signed-off-by: Emil Tantilov <emil.s.tantilov at intel.com>
Acked-by: Thierry Herbelot <thierry.herbelot at 6wind.com>
Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher at intel.com>
(cherry picked from commit 600a507ddcb99096731e1d96a3ebf43e20fc7f80)
Signed-off-by: Heitor R. Alves de Siqueira <halves at canonical.com>
---
drivers/net/ethernet/intel/ixgbe/ixgbe_sriov.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_sriov.c b/drivers/net/ethernet/intel/ixgbe/ixgbe_sriov.c
index 72084f70adbb..45ec9cb6a474 100644
--- a/drivers/net/ethernet/intel/ixgbe/ixgbe_sriov.c
+++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_sriov.c
@@ -1248,6 +1248,9 @@ int ixgbe_ndo_set_vf_spoofchk(struct net_device *netdev, int vf, bool setting)
struct ixgbe_hw *hw = &adapter->hw;
u32 regval;
+ if (vf >= adapter->num_vfs)
+ return -EINVAL;
+
adapter->vfinfo[vf].spoofchk_enabled = setting;
regval = IXGBE_READ_REG(hw, IXGBE_PFVFSPOOF(vf_target_reg));
--
2.17.1
More information about the kernel-team
mailing list