v1: This series fixes issues in the zxdh PF/VF mailbox handling that were found by a code scan of the driver, reported to us by the DPDK community. All of them are on the PF receive path, where fields of a message written by a VF into the shared BAR window are trusted more than they should be, plus two ordinary local bugs the scan found on the way:
- The dispatcher hands msg_head vport/pcieid to the handlers without comparing them with the sender, so a request can be aimed at any port (patch 3). - The header module_id is checked as 8-bit but indexes a table as 16-bit, and the async ack msg_id indexes the 256-entry seqid table without a bound check; both are out-of-bounds accesses up to a function call through a wild pointer (patches 7, 8). - The receive buffer is allocated with the sender-declared length but accessed as a full struct, corrupting the heap; and the async no-ack exit leaks the buffer, allowing a guest to exhaust the PF heap (patches 5, 6). - An uninitialised DTB entry is freed on a flow query error path, and an uninitialised multicast delete flag makes the PF delete the multicast entries of every port whenever one port leaves a group, with no attacker involved; the latter is a v25.11 regression (patches 2, 4). - A VLAN id above 4095 from a VF message turns into an out-of-range ERAM row index (patch 1). The sender check of patch 3 was verified on hardware; it stops at binding the request to a VF of the PF, a VF forging the identity of a sibling VF of the same PF is left to device-side protection that is planned. Each patch has been checked to apply on the current main branch. Junlong Wang (8): net/zxdh: reject out-of-range VLAN ID from VF net/zxdh: initialise DTB entry in flow query net/zxdh: refuse PF mailbox requests not naming a VF of this PF net/zxdh: initialise multicast delete flag net/zxdh: free receive buffer on the async no-ack exit net/zxdh: allocate a zeroed full-size payload buffer net/zxdh: check full 16-bit module id of received messages net/zxdh: check msg id before indexing the seqid table drivers/net/zxdh/zxdh_flow.c | 2 +- drivers/net/zxdh/zxdh_msg.c | 53 ++++++++++++++++++++++++++++------ drivers/net/zxdh/zxdh_tables.c | 2 +- 3 files changed, 46 insertions(+), 11 deletions(-) -- 2.27.0
