[PATCH v1 1/8] net/zxdh: reject out-of-range VLAN ID from VF

[Junlong Wang]

The PF handler for a VF's ZXDH_VLAN_FILTER_ADD/DEL message passes the
16-bit vlan_id from the message body to zxdh_vlan_filter_table_set()
without a range check. An id above 4095 becomes a row index outside
the VLAN filter groups the PF sets up for the function, and the NP
layer below only checks it against the end of the whole ERAM, so one
request from a guest reads, modifies and writes back unrelated table
rows.

Reject ids above RTE_ETHER_MAX_VLAN_ID where the value is taken out of
the message. Valid ids behave as before.

Fixes: b4f996b7fcf6 ("net/zxdh: optimize VLAN filter and offload")
Cc: stable at dpdk.org

Signed-off-by: Junlong Wang <wang.junlong1 at zte.com.cn>
---
 drivers/net/zxdh/zxdh_msg.c | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/drivers/net/zxdh/zxdh_msg.c b/drivers/net/zxdh/zxdh_msg.c
index 4b01daf37a..f0f0522817 100644
--- a/drivers/net/zxdh/zxdh_msg.c
+++ b/drivers/net/zxdh/zxdh_msg.c
@@ -1552,7 +1552,12 @@ zxdh_vf_vlan_filter_table_process(struct zxdh_hw *hw, uint16_t vport,
 	void *reply_data_addr = ZXDH_ADDR_OF(msg_reply_body, res_info, reply_data);
 	int ret = 0;
 
-	ret = zxdh_vlan_filter_table_set(hw, vport, vlan_id, enable);
+	if (vlan_id > RTE_ETHER_MAX_VLAN_ID) {
+		PMD_DRV_LOG(ERR, "vlan id %d is invalid", vlan_id);
+		ret = -EINVAL;
+	} else {
+		ret = zxdh_vlan_filter_table_set(hw, vport, vlan_id, enable);
+	}
 	if (ret)
 		sprintf(str, "vlan filter op-code[%d] vlan id:%d failed, code:%d\n",
 			enable, vlan_id, ret);
-- 
2.27.0
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://mails.dpdk.org/archives/stable/attachments/20261107/07e4860f/attachment.htm>