bnxt_en: Check the lengths of encapsulated firmware responses.

Firmware messages that are forwarded from PF to VFs are encapsulated.
The size of these encapsulated messages must not exceed the maximum
defined message size.  Add appropriate checks to avoid oversize
messages.  Firmware messages may be expanded in future specs and
this will provide some guardrails to avoid data corruption.

Signed-off-by: Michael Chan <michael.chan@broadcom.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt_sriov.c b/drivers/net/ethernet/broadcom/bnxt/bnxt_sriov.c
index f952963d594e3ffc04a885abd330c6488f58c85b..18ee471c0002fa4e8f49de47901a657f26453642 100644 (file)
--- a/drivers/net/ethernet/broadcom/bnxt/bnxt_sriov.c
+++ b/drivers/net/ethernet/broadcom/bnxt/bnxt_sriov.c
@@ -809,6 +809,9 @@ static int bnxt_hwrm_fwd_resp(struct bnxt *bp, struct bnxt_vf_info *vf,
        struct hwrm_fwd_resp_input req = {0};
        struct hwrm_fwd_resp_output *resp = bp->hwrm_cmd_resp_addr;
 
+       if (BNXT_FWD_RESP_SIZE_ERR(msg_size))
+               return -EINVAL;
+
        bnxt_hwrm_cmd_hdr_init(bp, &req, HWRM_FWD_RESP, -1, -1);
 
        /* Set the new target id */
@@ -845,6 +848,9 @@ static int bnxt_hwrm_fwd_err_resp(struct bnxt *bp, struct bnxt_vf_info *vf,
        struct hwrm_reject_fwd_resp_input req = {0};
        struct hwrm_reject_fwd_resp_output *resp = bp->hwrm_cmd_resp_addr;
 
+       if (BNXT_REJ_FWD_RESP_SIZE_ERR(msg_size))
+               return -EINVAL;
+
        bnxt_hwrm_cmd_hdr_init(bp, &req, HWRM_REJECT_FWD_RESP, -1, -1);
        /* Set the new target id */
        req.target_id = cpu_to_le16(vf->fw_fid);
@@ -877,6 +883,9 @@ static int bnxt_hwrm_exec_fwd_resp(struct bnxt *bp, struct bnxt_vf_info *vf,
        struct hwrm_exec_fwd_resp_input req = {0};
        struct hwrm_exec_fwd_resp_output *resp = bp->hwrm_cmd_resp_addr;
 
+       if (BNXT_EXEC_FWD_RESP_SIZE_ERR(msg_size))
+               return -EINVAL;
+
        bnxt_hwrm_cmd_hdr_init(bp, &req, HWRM_EXEC_FWD_RESP, -1, -1);
        /* Set the new target id */
        req.target_id = cpu_to_le16(vf->fw_fid);

diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt_sriov.h b/drivers/net/ethernet/broadcom/bnxt/bnxt_sriov.h
index d10f6f6c7860fda4c5ed73d6fd083656d13e2f40..6f6d85010ecf014a0145f6b868f81d7ca3665a83 100644 (file)
--- a/drivers/net/ethernet/broadcom/bnxt/bnxt_sriov.h
+++ b/drivers/net/ethernet/broadcom/bnxt/bnxt_sriov.h
@@ -11,6 +11,18 @@
 #ifndef BNXT_SRIOV_H
 #define BNXT_SRIOV_H
 
+#define BNXT_FWD_RESP_SIZE_ERR(n)                                      \
+       ((offsetof(struct hwrm_fwd_resp_input, encap_resp) + n) >       \
+        sizeof(struct hwrm_fwd_resp_input))
+
+#define BNXT_EXEC_FWD_RESP_SIZE_ERR(n)                                 \
+       ((offsetof(struct hwrm_exec_fwd_resp_input, encap_request) + n) >\
+        offsetof(struct hwrm_exec_fwd_resp_input, encap_resp_target_id))
+
+#define BNXT_REJ_FWD_RESP_SIZE_ERR(n)                                  \
+       ((offsetof(struct hwrm_reject_fwd_resp_input, encap_request) + n) >\
+        offsetof(struct hwrm_reject_fwd_resp_input, encap_resp_target_id))
+
 int bnxt_get_vf_config(struct net_device *, int, struct ifla_vf_info *);
 int bnxt_set_vf_mac(struct net_device *, int, u8 *);
 int bnxt_set_vf_vlan(struct net_device *, int, u16, u8, __be16);