ulp_mapper_tfc_em_tbl_process() pads the EM key to a record boundary
with ulp_blob_pad_push() but ignores its return value. The function
returns -1 and leaves the write index unchanged when the requested
pad does not fit in the blob, so with a long dynamic key the key was
used without its padding. The key length computed afterwards, and the
position at which the result is appended, are then wrong, and a
malformed EM entry is sent to the hardware.
Check the return value and fail the flow with -EINVAL, as the other
ulp_blob_pad_push() callers in the mapper already do.
Fixes: dd0191d5e70d ("net/bnxt/tf_ulp: support Thor2 ULP layer")
Cc: [email protected]
Signed-off-by: Manish Kurup <[email protected]>
---
v2:
* Split out of "net/bnxt: fix multiple truflow defects" (one fix per
patch); this is the EM key pad check in ulp_mapper_tfc.c.
* Rewrote the commit message: ulp_blob_pad_push() does not overrun the
blob, it fails without advancing the write index, and the failure
was being ignored.
* Use unlikely() and BNXT_DRV_DBG() like the rest of the file.
drivers/net/bnxt/tf_ulp/ulp_mapper_tfc.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
diff --git a/drivers/net/bnxt/tf_ulp/ulp_mapper_tfc.c
b/drivers/net/bnxt/tf_ulp/ulp_mapper_tfc.c
index 2cba6fffa8..7ace08838f 100644
--- a/drivers/net/bnxt/tf_ulp/ulp_mapper_tfc.c
+++ b/drivers/net/bnxt/tf_ulp/ulp_mapper_tfc.c
@@ -519,7 +519,10 @@ ulp_mapper_tfc_em_tbl_process(struct bnxt_ulp_mapper_parms
*parms,
align_len_bits = dparms->em_blk_align_bits - key_len;
}
- ulp_blob_pad_push(&key, align_len_bits);
+ if (unlikely(ulp_blob_pad_push(&key, align_len_bits) < 0)) {
+ BNXT_DRV_DBG(ERR, "Failed to pad EM key\n");
+ return -EINVAL;
+ }
key_len = ULP_BITS_2_BYTE(ulp_blob_data_len_get(&key));
ulp_blob_perform_byte_reverse(&key, key_len);
/* Create the result data blob */
--
2.31.1
