LTO build with -Werror reports stack overflows in tf_msg.c:
In function 'tf_global_cfg_set':
rte_memcpy.h:91:9: error: writing 16 bytes into a region of size 8
tf_msg.c:1574:45: note: at offset 48 into destination object 'req'
of size 56
In function 'tf_msg_set_if_tbl_entry':
rte_memcpy.h:105:9: error: writing 32 bytes into a region of size 0
tf_msg.c:1813:41: note: at offset 136 into destination object 'req'
of size 128
tf_msg_set_global_cfg() limits config_sz_in_bytes to 16, but
req.data and req.mask are each 8 bytes. A config larger than 8 bytes
overruns data into mask, and the mask copy runs off the end of req.
tf_msg_set_if_tbl_entry() has no check at all. data_sz_in_bytes is a
uint16_t copied into the 88 byte req.data. The ULP mapper fills it
from a blob of up to 128 bytes.
Check both against sizeof() of the destination, as the matching get
functions already do.
Fixes: 98487d729b4a ("net/bnxt: cleanup and refactor session management")
Cc: [email protected]
Signed-off-by: Stephen Hemminger <[email protected]>
---
drivers/net/bnxt/tf_core/tf_msg.c | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-)
diff --git a/drivers/net/bnxt/tf_core/tf_msg.c
b/drivers/net/bnxt/tf_core/tf_msg.c
index aab8d05d81..ab03afaabd 100644
--- a/drivers/net/bnxt/tf_core/tf_msg.c
+++ b/drivers/net/bnxt/tf_core/tf_msg.c
@@ -23,7 +23,6 @@
* means we have to manually sync hwrm with these defines if the
* tf.yaml changes.
*/
-#define TF_MSG_SET_GLOBAL_CFG_DATA_SIZE 16
#define TF_MSG_EM_INSERT_KEY_SIZE 64
#define TF_MSG_EM_INSERT_RECORD_SIZE 96
#define TF_MSG_TBL_TYPE_SET_DATA_SIZE 88
@@ -1618,7 +1617,7 @@ tf_msg_set_global_cfg(struct tf *tfp,
req.offset = tfp_cpu_to_le_32(params->offset);
/* Check for data size conformity */
- if (params->config_sz_in_bytes > TF_MSG_SET_GLOBAL_CFG_DATA_SIZE) {
+ if (params->config_sz_in_bytes > sizeof(req.data)) {
rc = -EINVAL;
TFP_DRV_LOG(ERR,
"%s: Invalid parameters for msg type, rc:%s\n",
@@ -1816,6 +1815,9 @@ tf_msg_set_if_tbl_entry(struct tf *tfp,
struct tf_dev_info *dev;
struct tf_session *tfs;
+ if (params->data_sz_in_bytes > sizeof(req.data))
+ return -EINVAL;
+
/* Retrieve the session information */
rc = tf_session_get_session(tfp, &tfs);
if (rc) {
--
2.53.0
