Commit 843faff8 authored Oct 26, 2018 by Alice Michael Committed by Jeff Kirsher Nov 14, 2018

virtchnl: Fix off by one error



When calculating the valid length for a VIRTCHNL_OP_ENABLE_CHANNELS
message, we accidentally allowed messages with one extra
virtchnl_channel_info structure on the end. This happened due
to an off by one error, because we forgot that valid_len already
accounted for one virtchnl_channel_info structure, so we need to
subtract one from the num_tc value.

Signed-off-by: Alice Michael <alice.michael@intel.com>
Tested-by: Andrew Bowers <andrewx.bowers@intel.com>
Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>

parent c9a98305

include/linux/avf/virtchnl.h

+2 −2

Original line number	Diff line number	Diff line
		@@ -819,7 +819,7 @@ virtchnl_vc_validate_vf_msg(struct virtchnl_version_info *ver, u32 v_opcode,
		if (msglen >= valid_len) {
		struct virtchnl_tc_info *vti =
		(struct virtchnl_tc_info *)msg;
		valid_len += vti->num_tc *
		valid_len += (vti->num_tc - 1) *
		sizeof(struct virtchnl_channel_info);
		if (vti->num_tc == 0)
		err_msg_format = true;

Admin message