Skip to content

Commit 55d2256

Browse files
lczapnikanguy11
authored andcommitted
i40e: add validation for ring_len param
The `ring_len` parameter provided by the virtual function (VF) is assigned directly to the hardware memory context (HMC) without any validation. To address this, introduce an upper boundary check for both Tx and Rx queue lengths. The maximum number of descriptors supported by the hardware is 8k-32. Additionally, enforce alignment constraints: Tx rings must be a multiple of 8, and Rx rings must be a multiple of 32. Fixes: 5c3c48a ("i40e: implement virtual device interface") Cc: stable@vger.kernel.org Signed-off-by: Lukasz Czapnik <lukasz.czapnik@intel.com> Reviewed-by: Aleksandr Loktionov <aleksandr.loktionov@intel.com> Signed-off-by: Przemek Kitszel <przemyslaw.kitszel@intel.com> Reviewed-by: Simon Horman <horms@kernel.org> Tested-by: Rafal Romanowski <rafal.romanowski@intel.com> Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
1 parent cbf658d commit 55d2256

1 file changed

Lines changed: 14 additions & 0 deletions

File tree

drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -653,6 +653,13 @@ static int i40e_config_vsi_tx_queue(struct i40e_vf *vf, u16 vsi_id,
653653

654654
/* only set the required fields */
655655
tx_ctx.base = info->dma_ring_addr / 128;
656+
657+
/* ring_len has to be multiple of 8 */
658+
if (!IS_ALIGNED(info->ring_len, 8) ||
659+
info->ring_len > I40E_MAX_NUM_DESCRIPTORS_XL710) {
660+
ret = -EINVAL;
661+
goto error_context;
662+
}
656663
tx_ctx.qlen = info->ring_len;
657664
tx_ctx.rdylist = le16_to_cpu(vsi->info.qs_handle[0]);
658665
tx_ctx.rdylist_act = 0;
@@ -716,6 +723,13 @@ static int i40e_config_vsi_rx_queue(struct i40e_vf *vf, u16 vsi_id,
716723

717724
/* only set the required fields */
718725
rx_ctx.base = info->dma_ring_addr / 128;
726+
727+
/* ring_len has to be multiple of 32 */
728+
if (!IS_ALIGNED(info->ring_len, 32) ||
729+
info->ring_len > I40E_MAX_NUM_DESCRIPTORS_XL710) {
730+
ret = -EINVAL;
731+
goto error_param;
732+
}
719733
rx_ctx.qlen = info->ring_len;
720734

721735
if (info->splithdr_enabled) {

0 commit comments

Comments
 (0)