ice: Add a boundary check in ice_xsk_umem() (65bb559b) · Commits · 戴 / test

In ice_xsk_umem(), variable qid which is later used as an array index, is not validated for a possible boundary exceedance. Because of that, a calling function might receive an invalid address, which causes general protection fault when dereferenced. To address this, add a boundary check to see if qid is greater than the size of a UMEM array. Also, don't let user change vsi->num_xsk_umems just by trying to setup a second UMEM if its value is already set up (i.e. UMEM region has already been allocated for this VSI). While at it, make sure that ring->zca.free pointer is always zeroed out if there is no UMEM on a specified ring. Signed-off-by:

Krzysztof Kazimierczak <krzysztof.kazimierczak@intel.com> Tested-by:

Andrew Bowers <andrewx.bowers@intel.com> Signed-off-by:

Jeff Kirsher <jeffrey.t.kirsher@intel.com>

drivers/net/ethernet/intel/ice/ice.h

+3 −2

Original line number	Diff line number	Diff line
		@@ -465,12 +465,13 @@ static inline void ice_set_ring_xdp(struct ice_ring *ring)
		static inline struct xdp_umem ice_xsk_umem(struct ice_ring ring)
		{
		struct xdp_umem **umems = ring->vsi->xsk_umems;
		int qid = ring->q_index;
		u16 qid = ring->q_index;

		if (ice_ring_is_xdp(ring))
		qid -= ring->vsi->num_xdp_txq;

		if (!umems \|\| !umems[qid] \|\| !ice_is_xdp_ena_vsi(ring->vsi))
		if (qid >= ring->vsi->num_xsk_umems \|\| !umems \|\| !umems[qid] \|\|
		!ice_is_xdp_ena_vsi(ring->vsi))
		return NULL;

		return umems[qid];

drivers/net/ethernet/intel/ice/ice_base.c

+1 −0

Original line number	Diff line number	Diff line
		@@ -326,6 +326,7 @@ int ice_setup_rx_ctx(struct ice_ring *ring)
		dev_info(&vsi->back->pdev->dev, "Registered XDP mem model MEM_TYPE_ZERO_COPY on Rx ring %d\n",
		ring->q_index);
		} else {
		ring->zca.free = NULL;
		if (!xdp_rxq_info_is_reg(&ring->xdp_rxq))
		xdp_rxq_info_reg(&ring->xdp_rxq,
		ring->netdev,

drivers/net/ethernet/intel/ice/ice_xsk.c

+2 −1

Original line number	Diff line number	Diff line
		@@ -414,6 +414,7 @@ ice_xsk_umem_enable(struct ice_vsi vsi, struct xdp_umem umem, u16 qid)
		if (vsi->type != ICE_VSI_PF)
		return -EINVAL;

		if (!vsi->num_xsk_umems)
		vsi->num_xsk_umems = min_t(u16, vsi->num_rxq, vsi->num_txq);
		if (qid >= vsi->num_xsk_umems)
		return -EINVAL;

Admin message