Patch "ethtool: fix setting key and resetting indir at once" has been added to the 6.10-stable tree

[Sasha Levin <sashal@xxxxxxxxxx>]

This is a note to let you know that I've just added the patch titled

    ethtool: fix setting key and resetting indir at once

to the 6.10-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     ethtool-fix-setting-key-and-resetting-indir-at-once.patch
and it can be found in the queue-6.10 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.



commit fc79acab6ab9cc70a3a2975ec5065406ce72c4d0
Author: Jakub Kicinski <kuba@xxxxxxxxxx>
Date:   Thu Jul 25 15:23:51 2024 -0700

    ethtool: fix setting key and resetting indir at once
    
    [ Upstream commit 7195f0ef7f5b8c678cf28de7c9b619cb908b482c ]
    
    The indirection table and the key follow struct ethtool_rxfh
    in user memory.
    
    To reset the indirection table user space calls SET_RXFH with
    table of size 0 (OTOH to say "no change" it should use -1 / ~0).
    The logic for calculating the offset where they key sits is
    incorrect in this case, as kernel would still offset by the full
    table length, while for the reset there is no indir table and
    key is immediately after the struct.
    
      $ ethtool -X eth0 default hkey 01:02:03...
      $ ethtool -x eth0
      [...]
      RSS hash key:
    00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00
      [...]
    
    Fixes: 3de0b592394d ("ethtool: Support for configurable RSS hash key")
    Signed-off-by: Jakub Kicinski <kuba@xxxxxxxxxx>
    Signed-off-by: David S. Miller <davem@xxxxxxxxxxxxx>
    Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>

diff --git a/net/ethtool/ioctl.c b/net/ethtool/ioctl.c
index 223dcd25d88a2..fcc3dbef8b503 100644
--- a/net/ethtool/ioctl.c
+++ b/net/ethtool/ioctl.c
@@ -1277,11 +1277,11 @@ static noinline_for_stack int ethtool_set_rxfh(struct net_device *dev,
 	u32 rss_cfg_offset = offsetof(struct ethtool_rxfh, rss_config[0]);
 	const struct ethtool_ops *ops = dev->ethtool_ops;
 	u32 dev_indir_size = 0, dev_key_size = 0, i;
+	u32 user_indir_len = 0, indir_bytes = 0;
 	struct ethtool_rxfh_param rxfh_dev = {};
 	struct netlink_ext_ack *extack = NULL;
 	struct ethtool_rxnfc rx_rings;
 	struct ethtool_rxfh rxfh;
-	u32 indir_bytes = 0;
 	u8 *rss_config;
 	int ret;
 
@@ -1342,6 +1342,7 @@ static noinline_for_stack int ethtool_set_rxfh(struct net_device *dev,
 	 */
 	if (rxfh.indir_size &&
 	    rxfh.indir_size != ETH_RXFH_INDIR_NO_CHANGE) {
+		user_indir_len = indir_bytes;
 		rxfh_dev.indir = (u32 *)rss_config;
 		rxfh_dev.indir_size = dev_indir_size;
 		ret = ethtool_copy_validate_indir(rxfh_dev.indir,
@@ -1368,7 +1369,7 @@ static noinline_for_stack int ethtool_set_rxfh(struct net_device *dev,
 		rxfh_dev.key_size = dev_key_size;
 		rxfh_dev.key = rss_config + indir_bytes;
 		if (copy_from_user(rxfh_dev.key,
-				   useraddr + rss_cfg_offset + indir_bytes,
+				   useraddr + rss_cfg_offset + user_indir_len,
 				   rxfh.key_size)) {
 			ret = -EFAULT;
 			goto out;