[PATCH v1 3/8] net/zxdh: refuse PF mailbox requests not naming a VF of this PF

[Junlong Wang]

The PF dispatcher zxdh_config_process_callback() hands the
msghead->vport and msghead->pcieid of a request, both written by the
VF into its BAR0 mailbox window, straight to the handlers, and
nothing on the receive path compares them with the sender. One
message can therefore be aimed at any port: it rewrites or deletes
the port attribute entry of the PF itself or of another VF.

Add zxdh_msg_head_is_own_vf() before the dispatch: pcieid must be a
VF pcieid whose PF is this PF, and vport must carry vf_flag with this
PF's epid and pfid. The vport vfid is deliberately not compared with
the pcieid function number: vfid is allocated sequentially across all
PFs of an epid while the function number restarts at 0 for each PF.
Anything else is answered ZXDH_REPS_INVALID and no handler runs;
messages built by zxdh_msg_head_build() pass unchanged.

A VF that forges both pcieid and vport of a sibling VF of the same PF
still cannot be told apart by the driver; protection against that
case is planned on the device side. This patch closes the PF-port and
cross-PF cases.

Fixes: 2e22ff2528db ("net/zxdh: provide PF/VF message interrupt callback")
Cc: stable at dpdk.org

Signed-off-by: Junlong Wang <wang.junlong1 at zte.com.cn>
---
 drivers/net/zxdh/zxdh_msg.c | 25 ++++++++++++++++++++++++-
 1 file changed, 24 insertions(+), 1 deletion(-)

diff --git a/drivers/net/zxdh/zxdh_msg.c b/drivers/net/zxdh/zxdh_msg.c
index f0f0522817..6aafefe289 100644
--- a/drivers/net/zxdh/zxdh_msg.c
+++ b/drivers/net/zxdh/zxdh_msg.c
@@ -2397,6 +2397,24 @@ static const zxdh_msg_process_callback zxdh_proc_cb[] = {
 	[ZXDH_FLOW_HW_FLUSH] = zxdh_vf_flow_hw_flush,
 };
 
+/*
+ * The msg head is written by the VF driver: the vport and pcieid it carries
+ * must name one VF of this PF, not the PF itself or a port of another PF.
+ */
+static bool
+zxdh_msg_head_is_own_vf(struct zxdh_hw *hw, struct zxdh_msg_head *msghead)
+{
+	union zxdh_virport_num vport = {.vport = msghead->vport};
+
+	if ((msghead->pcieid & ZXDH_PCIEID_IS_PF_MASK) ||
+			ZXDH_PF_PCIE_ID(msghead->pcieid) != hw->pcie_id)
+		return false;
+
+	return vport.vf_flag &&
+		vport.epid == hw->vport.epid &&
+		vport.pfid == hw->vport.pfid;
+}
+
 static inline int
 zxdh_config_process_callback(struct zxdh_hw *hw, struct zxdh_msg_info *msg_info,
 	void *res, uint16_t *res_len)
@@ -2408,7 +2426,12 @@ zxdh_config_process_callback(struct zxdh_hw *hw, struct zxdh_msg_info *msg_info,
 		PMD_DRV_LOG(ERR, " invalid param");
 		return -1;
 	}
-	if (zxdh_proc_cb[msghead->msg_type]) {
+
+	if (!zxdh_msg_head_is_own_vf(hw, msghead)) {
+		PMD_DRV_LOG(ERR, "msg_type %d vport 0x%x pcieid 0x%x is not a VF of PF pcieid 0x%x",
+			msghead->msg_type, msghead->vport, msghead->pcieid, hw->pcie_id);
+		ZXDH_SET(msg_reply_body, res, flag, ZXDH_REPS_INVALID);
+	} else if (zxdh_proc_cb[msghead->msg_type]) {
 		ret = zxdh_proc_cb[msghead->msg_type](hw, msghead->vport, msghead->pcieid,
 					(void *)&msg_info->data, res, res_len);
 		if (!ret)
-- 
2.27.0
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://mails.dpdk.org/archives/stable/attachments/20261107/c17d4edf/attachment.htm>