Commit a3336056 authored by Jedrzej Jagielski's avatar Jedrzej Jagielski Committed by Jakub Kicinski
Browse files

ice: Fix memory management in ice_ethtool_fdir.c 



Fix ethtool FDIR logic to not use memory after its release.
In the ice_ethtool_fdir.c file there are 2 spots where code can
refer to pointers which may be missing.

In the ice_cfg_fdir_xtrct_seq() function seg may be freed but
even then may be still used by memcpy(&tun_seg[1], seg, sizeof(*seg)).

In the ice_add_fdir_ethtool() function struct ice_fdir_fltr *input
may first fail to be added via ice_fdir_update_list_entry() but then
may be deleted by ice_fdir_update_list_entry.

Terminate in both cases when the returned value of the previous
operation is other than 0, free memory and don't use it anymore.

Reported-by: default avatarMichal Schmidt <mschmidt@redhat.com>
Link: https://bugzilla.redhat.com/show_bug.cgi?id=2208423


Fixes: cac2a27c ("ice: Support IPv4 Flow Director filters")
Reviewed-by: default avatarPrzemek Kitszel <przemyslaw.kitszel@intel.com>
Signed-off-by: default avatarJedrzej Jagielski <jedrzej.jagielski@intel.com>
Reviewed-by: default avatarLeon Romanovsky <leonro@nvidia.com>
Tested-by: Pucha Himasekhar Reddy <himasekharx.reddy.pucha@intel.com> (A Contingent worker at Intel)
Signed-off-by: default avatarTony Nguyen <anthony.l.nguyen@intel.com>
Link: https://lore.kernel.org/r/20230721155854.1292805-1-anthony.l.nguyen@intel.com


Signed-off-by: default avatarJakub Kicinski <kuba@kernel.org>
parent d11b0df7

drivers/net/ethernet/intel/ice/ice_ethtool_fdir.c

+14 −12
Original line number Diff line number Diff line
@@ -1281,16 +1281,21 @@ ice_cfg_fdir_xtrct_seq(struct ice_pf *pf, struct ethtool_rx_flow_spec *fsp, 
				     ICE_FLOW_FLD_OFF_INVAL);

	}



	/* add filter for outer headers */

	fltr_idx = ice_ethtool_flow_to_fltr(fsp->flow_type & ~FLOW_EXT);



	assign_bit(fltr_idx, hw->fdir_perfect_fltr, perfect_filter);



	/* add filter for outer headers */

	ret = ice_fdir_set_hw_fltr_rule(pf, seg, fltr_idx,

					ICE_FD_HW_SEG_NON_TUN);

	if (ret == -EEXIST)

		/* Rule already exists, free memory and continue */

		devm_kfree(dev, seg);

	else if (ret)

	if (ret == -EEXIST) {

		/* Rule already exists, free memory and count as success */

		ret = 0;

		goto err_exit;

	} else if (ret) {

		/* could not write filter, free memory */

		goto err_exit;

	}



	/* make tunneled filter HW entries if possible */

	memcpy(&tun_seg[1], seg, sizeof(*seg));
@@ -1305,18 +1310,13 @@ ice_cfg_fdir_xtrct_seq(struct ice_pf *pf, struct ethtool_rx_flow_spec *fsp, 
		devm_kfree(dev, tun_seg);

	}



	if (perfect_filter)

		set_bit(fltr_idx, hw->fdir_perfect_fltr);

	else

		clear_bit(fltr_idx, hw->fdir_perfect_fltr);



	return ret;



err_exit:

	devm_kfree(dev, tun_seg);

	devm_kfree(dev, seg);



	return -EOPNOTSUPP;

	return ret;

}



/**
@@ -1914,7 +1914,9 @@ int ice_add_fdir_ethtool(struct ice_vsi *vsi, struct ethtool_rxnfc *cmd) 
	input->comp_report = ICE_FXD_FLTR_QW0_COMP_REPORT_SW_FAIL;



	/* input struct is added to the HW filter list */

	ice_fdir_update_list_entry(pf, input, fsp->location);

	ret = ice_fdir_update_list_entry(pf, input, fsp->location);

	if (ret)

		goto release_lock;



	ret = ice_fdir_write_all_fltr(pf, input, true);

	if (ret)