Re: [PATCH] IB/mlx5: add checking for "vf" from do_setvfinfo()

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



On Fri, Apr 12, 2019 at 08:25:05PM +0000, Parav Pandit wrote:
> 
> 
> > -----Original Message-----
> > From: linux-rdma-owner@xxxxxxxxxxxxxxx <linux-rdma-
> > owner@xxxxxxxxxxxxxxx> On Behalf Of Dan Carpenter
> > Sent: Friday, April 12, 2019 12:55 PM
> > To: Leon Romanovsky <leon@xxxxxxxxxx>; Eli Cohen <eli@xxxxxxxxxxxx>
> > Cc: Doug Ledford <dledford@xxxxxxxxxx>; Jason Gunthorpe <jgg@xxxxxxxx>;
> > linux-rdma@xxxxxxxxxxxxxxx; kernel-janitors@xxxxxxxxxxxxxxx
> > Subject: [PATCH] IB/mlx5: add checking for "vf" from do_setvfinfo()
> > 
> > My static checker complains that these "vf" variables come from the user in
> > do_setvfinfo() and haven't been checked to make sure they're valid.
> > 
> > Fixes: eff901d30e6c ("IB/mlx5: Implement callbacks for manipulating VFs")
> > Signed-off-by: Dan Carpenter <dan.carpenter@xxxxxxxxxx>
> > ---
> > Untested static checker stuff.  Please review carefully.
> > 
> >  drivers/infiniband/hw/mlx5/ib_virt.c | 6 ++++++
> >  1 file changed, 6 insertions(+)
> > 
> > diff --git a/drivers/infiniband/hw/mlx5/ib_virt.c
> > b/drivers/infiniband/hw/mlx5/ib_virt.c
> > index 649a3364f838..9a8eebe3d462 100644
> > --- a/drivers/infiniband/hw/mlx5/ib_virt.c
> > +++ b/drivers/infiniband/hw/mlx5/ib_virt.c
> > @@ -56,6 +56,9 @@ int mlx5_ib_get_vf_config(struct ib_device *device, int
> > vf, u8 port,
> >  	struct mlx5_hca_vport_context *rep;
> >  	int err;
> > 
> > +	if (vf < 0 || vf >= pci_sriov_get_totalvfs(mdev->pdev))
> > +		return -EINVAL;
> > +
> I traced back ndo_get_vf_config and friend functions. vf number is u32 from user space.
> 
> And all the VF operations at ndo ops level and at driver level should be changed from int to u32.
> After that vf < 0 check is not needed.
> 
> >  	rep = kzalloc(sizeof(*rep), GFP_KERNEL);
> >  	if (!rep)
> >  		return -ENOMEM;
> > @@ -99,6 +102,9 @@ int mlx5_ib_set_vf_link_state(struct ib_device *device,
> > int vf,
> >  	struct mlx5_vf_context *vfs_ctx = mdev->priv.sriov.vfs_ctx;
> >  	int err;
> > 
> > +	if (vf < 0 || vf >= pci_sriov_get_totalvfs(mdev->pdev))
> > +		return -EINVAL;
> > +
> We are currently working on a patch to post in mid-May to not have access to pdev in this file.
> If the vf > desired value, HCA firmware should be failing this command too.

I'm not sure what you want me to do with this information.  :P

regards,
dan carpenter



[Index of Archives]     [Kernel Development]     [Kernel Announce]     [Kernel Newbies]     [Linux Networking Development]     [Share Photos]     [IDE]     [Security]     [Git]     [Netfilter]     [Yosemite News]     [MIPS Linux]     [ARM Linux]     [Device Mapper]

  Powered by Linux