v2:
- Patch 8/8: add the missing check in zxdh_bar_msg_ack_async_msg_proc(),
the hunk described by the commit message was dropped when the v1
changes were carried into the tree, only the reply-path check in
zxdh_bar_chan_sync_msg_reps_get() was actually sent, so the
VF-reachable path was unchanged (reported by maintainer review).
- Patch 4/8: drop the paragraph claiming what the compiler does with
the uninitialised read at -O1 and above; the fix does not depend
on codegen for undefined behaviour, and just state that del_flag
is read uninitialized when the group loop breaks early.
v1:
This series fixes issues in the zxdh PF/VF mailbox handling that were
found by a code scan of the driver, reported to us by the DPDK
community. All of them are on the PF receive path, where fields of a
message written by a VF into the shared BAR window are trusted more
than they should be, plus two ordinary local bugs the scan found on
the way:
- The dispatcher hands msg_head vport/pcieid to the handlers without
comparing them with the sender, so a request can be aimed at any
port (patch 3).
- The header module_id is checked as 8-bit but indexes a table as
16-bit, and the async ack msg_id indexes the 256-entry seqid table
without a bound check; both are out-of-bounds accesses up to a
function call through a wild pointer (patches 7, 8).
- The receive buffer is allocated with the sender-declared length but
accessed as a full struct, corrupting the heap; and the async
no-ack exit leaks the buffer, allowing a guest to exhaust the PF
heap (patches 5, 6).
- An uninitialised DTB entry is freed on a flow query error path,
and an uninitialised multicast delete flag makes the PF delete the
multicast entries of every port whenever one port leaves a group,
with no attacker involved; the latter is a v25.11 regression
(patches 2, 4).
- A VLAN id above 4095 from a VF message turns into an out-of-range
ERAM row index (patch 1).
The sender check of patch 3 was verified on hardware; it stops at
binding the request to a VF of the PF, a VF forging the identity of a
sibling VF of the same PF is left to device-side protection that is
planned. Each patch has been checked to apply on the current main
branch.
Junlong Wang (8):
net/zxdh: reject out-of-range VLAN ID from VF
net/zxdh: initialise DTB entry in flow query
net/zxdh: refuse PF mailbox requests not naming a VF of this PF
net/zxdh: initialise multicast delete flag
net/zxdh: free receive buffer on the async no-ack exit
net/zxdh: allocate a zeroed full-size payload buffer
net/zxdh: check full 16-bit module id of recv msg
net/zxdh: check msg id before indexing the seqid table
drivers/net/zxdh/zxdh_flow.c | 2 +-
drivers/net/zxdh/zxdh_msg.c | 61 ++++++++++++++++++++++++++++------
drivers/net/zxdh/zxdh_tables.c | 2 +-
3 files changed, 53 insertions(+), 12 deletions(-)
--
2.27.0
