From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mga11.intel.com (mga11.intel.com [192.55.52.93]) by dpdk.org (Postfix) with ESMTP id D9F315589 for ; Mon, 23 Jan 2017 08:46:26 +0100 (CET) Received: from orsmga004.jf.intel.com ([10.7.209.38]) by fmsmga102.fm.intel.com with ESMTP; 22 Jan 2017 23:46:25 -0800 X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="5.33,273,1477983600"; d="scan'208";a="51485960" Received: from yliu-dev.sh.intel.com ([10.239.67.162]) by orsmga004.jf.intel.com with ESMTP; 22 Jan 2017 23:46:25 -0800 From: Yuanhan Liu To: Rasesh Mody Cc: Yuanhan Liu , dpdk stable Date: Mon, 23 Jan 2017 15:47:21 +0800 Message-Id: <1485157675-32114-46-git-send-email-yuanhan.liu@linux.intel.com> X-Mailer: git-send-email 1.9.0 In-Reply-To: <1485157675-32114-1-git-send-email-yuanhan.liu@linux.intel.com> References: <1485157675-32114-1-git-send-email-yuanhan.liu@linux.intel.com> Subject: [dpdk-stable] patch 'net/qede/base: fix Rx queue access by malicious VFs' has been queued to stable release 16.11.1 X-BeenThere: stable@dpdk.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: patches for DPDK stable branches List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 23 Jan 2017 07:46:27 -0000 Hi, FYI, your patch has been queued to stable release 16.11.1 Note it hasn't been pushed to http://dpdk.org/browse/dpdk-stable yet. It will be pushed if I get no objections before 01/28/17. So please shout if anyone has objections. --- Note 16.11 is a LTS release. v16.11.1 is planned to be released shortly (about 2-3 weeks) after v17.02. --- Thanks. --yliu --- >>From b97ae1650f140e7e14d8d497ead4f2c117b8dab2 Mon Sep 17 00:00:00 2001 From: Rasesh Mody Date: Thu, 22 Dec 2016 16:50:02 -0800 Subject: [PATCH] net/qede/base: fix Rx queue access by malicious VFs [ upstream commit 917ce8bd36f8fca277b09c0717fccb6ec60f4f1d ] Rx queue access is still done prior to the index being validated by PF. Hence move Rx queue and status block validation check before accessing Rx queue to prevent malicious VFs from using out-of-bound queue indices. Fixes: 98bc693e1938 ("net/qede/base: change queue start") Signed-off-by: Rasesh Mody --- drivers/net/qede/base/ecore_sriov.c | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) diff --git a/drivers/net/qede/base/ecore_sriov.c b/drivers/net/qede/base/ecore_sriov.c index de54b9a..1255296 100644 --- a/drivers/net/qede/base/ecore_sriov.c +++ b/drivers/net/qede/base/ecore_sriov.c @@ -1968,6 +1968,11 @@ static void ecore_iov_vf_mbx_start_rxq(struct ecore_hwfn *p_hwfn, enum _ecore_status_t rc; req = &mbx->req_virt->start_rxq; + + if (!ecore_iov_validate_rxq(p_hwfn, vf, req->rx_qid) || + !ecore_iov_validate_sb(p_hwfn, vf, req->hw_sb)) + goto out; + OSAL_MEMSET(&p_params, 0, sizeof(p_params)); p_params.queue_id = (u8)vf->vf_queues[req->rx_qid].fw_rx_qid; p_params.vf_qid = req->rx_qid; @@ -1976,10 +1981,6 @@ static void ecore_iov_vf_mbx_start_rxq(struct ecore_hwfn *p_hwfn, p_params.sb = req->hw_sb; p_params.sb_idx = req->sb_index; - if (!ecore_iov_validate_rxq(p_hwfn, vf, req->rx_qid) || - !ecore_iov_validate_sb(p_hwfn, vf, req->hw_sb)) - goto out; - /* Legacy VFs have their Producers in a different location, which they * calculate on their own and clean the producer prior to this. */ -- 1.9.0