lkml.org 
[lkml]   [2019]   [Dec]   [11]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 4.19 046/243] virtchnl: Fix off by one error
    Date
    From: Alice Michael <alice.michael@intel.com>

    [ Upstream commit 843faff87af261bf55eda719a06087af0486a168 ]

    When calculating the valid length for a VIRTCHNL_OP_ENABLE_CHANNELS
    message, we accidentally allowed messages with one extra
    virtchnl_channel_info structure on the end. This happened due
    to an off by one error, because we forgot that valid_len already
    accounted for one virtchnl_channel_info structure, so we need to
    subtract one from the num_tc value.

    Signed-off-by: Alice Michael <alice.michael@intel.com>
    Tested-by: Andrew Bowers <andrewx.bowers@intel.com>
    Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
    Signed-off-by: Sasha Levin <sashal@kernel.org>
    ---
    include/linux/avf/virtchnl.h | 4 ++--
    1 file changed, 2 insertions(+), 2 deletions(-)

    diff --git a/include/linux/avf/virtchnl.h b/include/linux/avf/virtchnl.h
    index 212b3822d1804..92d179fb6d59e 100644
    --- a/include/linux/avf/virtchnl.h
    +++ b/include/linux/avf/virtchnl.h
    @@ -798,8 +798,8 @@ virtchnl_vc_validate_vf_msg(struct virtchnl_version_info *ver, u32 v_opcode,
    if (msglen >= valid_len) {
    struct virtchnl_tc_info *vti =
    (struct virtchnl_tc_info *)msg;
    - valid_len += vti->num_tc *
    - sizeof(struct virtchnl_channel_info);
    + valid_len += (vti->num_tc - 1) *
    + sizeof(struct virtchnl_channel_info);
    if (vti->num_tc == 0)
    err_msg_format = true;
    }
    --
    2.20.1


    \
     
     \ /
      Last update: 2022-09-17 16:06    [W:3.091 / U:0.112 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site