From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mails.dpdk.org (mails.dpdk.org [217.70.189.124]) by inbox.dpdk.org (Postfix) with ESMTP id 37E7745845; Thu, 22 Aug 2024 12:51:19 +0200 (CEST) Received: from mails.dpdk.org (localhost [127.0.0.1]) by mails.dpdk.org (Postfix) with ESMTP id CA99242EC5; Thu, 22 Aug 2024 12:51:00 +0200 (CEST) Received: from mgamail.intel.com (mgamail.intel.com [198.175.65.20]) by mails.dpdk.org (Postfix) with ESMTP id 67EBE42E9D for ; Thu, 22 Aug 2024 12:50:53 +0200 (CEST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=intel.com; i=@intel.com; q=dns/txt; s=Intel; t=1724323854; x=1755859854; h=from:to:cc:subject:date:message-id:in-reply-to: references:mime-version:content-transfer-encoding; bh=vMA047NQAw8nCTmvhb2VtOcpilkawQnq2VTMGzChbSQ=; b=CC/xdOaxlG23gNe2xxhPE4r2HFvm/qjLVs1IXK8UOjt0g+nGMWgVQjnL MkuyA8k3iYKcDn3gA5CBuGISLbUUbJuD3w9kA5Fd5I0Q6gSHwgH5WDjmt geg1EgUTtQ73Zqd6l4L5bmxp1ajKd0Sdl0MJ8ihDQpp+tQ4ChPJYXv2rN dWy4O0SISbHvFwoflk86i8B7Zo+3BGSsLDNj0ahpbAnQfOzgpppfflg6S Sheqe9sDvMeDtWxGpQ5WouVE4i61E0+3AsAkyL1UeNu2+GHeir3cA22Zs 6PaRmPPnmfilmHmsyEP4WvII85xE0ZaNPwCtx/Bc9weIZuX3Wnw1FYNSa Q==; X-CSE-ConnectionGUID: pIK+hXTrT8SPlIuEO9J5Qg== X-CSE-MsgGUID: flC1UdcRRxWI5CMWPuO5WQ== X-IronPort-AV: E=McAfee;i="6700,10204,11171"; a="22542222" X-IronPort-AV: E=Sophos;i="6.10,166,1719903600"; d="scan'208";a="22542222" Received: from fmviesa010.fm.intel.com ([10.60.135.150]) by orvoesa112.jf.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 22 Aug 2024 03:50:53 -0700 X-CSE-ConnectionGUID: QRF9lhb7TYe7jpKzLRkwnQ== X-CSE-MsgGUID: 5U1Mf2YmQMWOZZ5E/zvVQw== X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="6.10,166,1719903600"; d="scan'208";a="61559733" Received: from unknown (HELO npf-hyd-clx-03..) ([10.145.170.182]) by fmviesa010.fm.intel.com with ESMTP; 22 Aug 2024 03:50:51 -0700 From: Soumyadeep Hore To: bruce.richardson@intel.com, ian.stokes@intel.com, aman.deep.singh@intel.com Cc: dev@dpdk.org, shaiq.wani@intel.com Subject: [PATCH v1 04/12] net/ice: avoid reading past end of PFA Date: Thu, 22 Aug 2024 09:56:04 +0000 Message-ID: <20240822095612.216214-5-soumyadeep.hore@intel.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20240822095612.216214-1-soumyadeep.hore@intel.com> References: <20240822095612.216214-1-soumyadeep.hore@intel.com> MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-BeenThere: dev@dpdk.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DPDK patches and discussions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: dev-bounces@dpdk.org The ice_get_pfa_module_tlv() function iterates over the Preserved Fields Area to read data from the Shadow RAM, including the Part Board Assembly data, among others. If the specific TLV being requested is not found in the current NVM, the code will read past the end of the PFA, misinterpreting the last word of the PFA and the word just after the PFA as another TLV. This typically results in one extra iteration before the length check of the while loop is triggered. Signed-off-by: Soumyadeep Hore --- drivers/net/ice/base/ice_nvm.c | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) diff --git a/drivers/net/ice/base/ice_nvm.c b/drivers/net/ice/base/ice_nvm.c index 5e982de4b5..0124cef04c 100644 --- a/drivers/net/ice/base/ice_nvm.c +++ b/drivers/net/ice/base/ice_nvm.c @@ -498,11 +498,16 @@ ice_get_pfa_module_tlv(struct ice_hw *hw, u16 *module_tlv, u16 *module_tlv_len, ice_debug(hw, ICE_DBG_INIT, "Failed to read PFA length.\n"); return status; } - /* Starting with first TLV after PFA length, iterate through the list + /* The Preserved Fields Area contains a sequence of TLVs which define + * its contents. The PFA length includes all of the TLVs, plus its + * initial length word itself, *and* one final word at the end of all + * of the TLVs. + * + * Starting with first TLV after PFA length, iterate through the list * of TLVs to find the requested one. */ next_tlv = pfa_ptr + 1; - while (next_tlv < ((u32)pfa_ptr + pfa_len)) { + while (next_tlv < ((u32)pfa_ptr + pfa_len - 1)) { u16 tlv_sub_module_type; u16 tlv_len; -- 2.43.0