Commit e80bd08f authored by Edward Cree's avatar Edward Cree Committed by David S. Miller
Browse files

sfc: ensure type is valid before updating seen_gen 



In the case of invalid or corrupted v2 counter update packets,
 efx_tc_rx_version_2() returns EFX_TC_COUNTER_TYPE_MAX.  In this case
 we should not attempt to update generation counts as this will write
 beyond the end of the seen_gen array.

Reported-by: default avatarcoverity-bot <keescook+coverity-bot@chromium.org>
Addresses-Coverity-ID: 1527356 ("Memory - illegal accesses")
Fixes: 25730d8b ("sfc: add extra RX channel to receive MAE counter updates on ef100")
Signed-off-by: default avatarEdward Cree <ecree.xilinx@gmail.com>
Reviewed-by: default avatarKees Cook <keescook@chromium.org>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent 9f225444

drivers/net/ethernet/sfc/tc_counters.c

+9 −7
Original line number Diff line number Diff line
@@ -476,6 +476,7 @@ static bool efx_tc_rx(struct efx_rx_queue *rx_queue, u32 mark) 
		goto out;

	}



	if (type < EFX_TC_COUNTER_TYPE_MAX) {

		/* Update seen_gen unconditionally, to avoid a missed wakeup if

		 * we race with efx_mae_stop_counters().

		 */
@@ -483,6 +484,7 @@ static bool efx_tc_rx(struct efx_rx_queue *rx_queue, u32 mark) 
		if (efx->tc->flush_counters &&

		    (s32)(efx->tc->flush_gen[type] - mark) <= 0)

			wake_up(&efx->tc->flush_wq);

	}

out:

	efx_free_rx_buffers(rx_queue, rx_buf, 1);

	channel->rx_pkt_n_frags = 0;