[PATCH v1 8/8] net/zxdh: check msg id before indexing the seqid table

[Junlong Wang]

zxdh_bar_msg_ack_async_msg_proc() indexes the 256-entry
g_seqid_ring.reps_info_tbl[] with the 16-bit msg_id taken straight
from the message header a VF writes into the PF/VF window. Nothing on
the receive path compares it with ZXDH_BAR_SEQID_NUM_MAX, so a forged
asynchronous ack with an out-of-range msg_id makes the PF read, and
under some conditions write, up to 1 MiB past the table, crashing the
process that drives the PF.

Reject msg_id >= ZXDH_BAR_SEQID_NUM_MAX before the slot pointer is
formed: the id is logged as invalid and the message dropped, like an
id that is already released. The driver only ever allocates ids below
256, so a well-formed peer is unaffected.

Apply the same comparison in zxdh_bar_chan_sync_msg_reps_get(), which
indexes the same table with the msg_id of a reply; that path is not
reachable from a VF today, the check is hardening.

Fixes: 3630ac8bd81f ("net/zxdh: configure interrupt")
Cc: stable at dpdk.org

Signed-off-by: Junlong Wang <wang.junlong1 at zte.com.cn>
---
 drivers/net/zxdh/zxdh_msg.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/drivers/net/zxdh/zxdh_msg.c b/drivers/net/zxdh/zxdh_msg.c
index 77b8df2f12..5e4085e4fa 100644
--- a/drivers/net/zxdh/zxdh_msg.c
+++ b/drivers/net/zxdh/zxdh_msg.c
@@ -703,6 +703,11 @@ zxdh_bar_chan_sync_msg_reps_get(uint64_t subchan_addr,
 
 	zxdh_bar_chan_msg_header_get(subchan_addr, &msg_header);
 	msg_id = msg_header.msg_id;
+	if (msg_id >= ZXDH_BAR_SEQID_NUM_MAX) {
+		PMD_MSG_LOG(ERR, "msg_id %u is invalid", msg_id);
+		return ZXDH_BAR_MSG_ERR_REPLY;
+	}
+
 	struct zxdh_seqid_item *reps_info = &g_seqid_ring.reps_info_tbl[msg_id];
 
 	if (reps_info->flag != ZXDH_REPS_INFO_FLAG_USED) {
-- 
2.27.0
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://mails.dpdk.org/archives/stable/attachments/20261107/7f92bec6/attachment.htm>