[Intel-wired-lan] [iwl-net v2 5/5] ice: fix using untrusted value of pkt_len in ice_vc_fdir_parse_raw()

[Martyna Szapar-Mudlaw]

From: Mateusz Polchlopek <mateusz.polchlo...@intel.com>

Fix using the untrusted value of proto->raw.pkt_len in function
ice_vc_fdir_parse_raw() by verifying if it does not exceed the
VIRTCHNL_MAX_SIZE_RAW_PACKET value.

Fixes: 99f419df8a5c ("ice: enable FDIR filters from raw binary patterns for 
VFs")
Signed-off-by: Mateusz Polchlopek <mateusz.polchlo...@intel.com>
Signed-off-by: Martyna Szapar-Mudlaw <martyna.szapar-mud...@linux.intel.com>
---
 .../ethernet/intel/ice/ice_virtchnl_fdir.c    | 25 +++++++++++++------
 1 file changed, 17 insertions(+), 8 deletions(-)

diff --git a/drivers/net/ethernet/intel/ice/ice_virtchnl_fdir.c 
b/drivers/net/ethernet/intel/ice/ice_virtchnl_fdir.c
index 14e3f0f89c78..6250629ee8f9 100644
--- a/drivers/net/ethernet/intel/ice/ice_virtchnl_fdir.c
+++ b/drivers/net/ethernet/intel/ice/ice_virtchnl_fdir.c
@@ -835,18 +835,27 @@ ice_vc_fdir_parse_raw(struct ice_vf *vf,
        u8 *pkt_buf, *msk_buf __free(kfree);
        struct ice_parser_result rslt;
        struct ice_pf *pf = vf->pf;
+       u16 pkt_len, udp_port = 0;
        struct ice_parser *psr;
        int status = -ENOMEM;
        struct ice_hw *hw;
-       u16 udp_port = 0;
 
-       pkt_buf = kzalloc(proto->raw.pkt_len, GFP_KERNEL);
-       msk_buf = kzalloc(proto->raw.pkt_len, GFP_KERNEL);
+       if (!proto->raw.pkt_len)
+               return -EINVAL;
+
+       pkt_len = proto->raw.pkt_len;
+
+       if (!pkt_len || pkt_len > VIRTCHNL_MAX_SIZE_RAW_PACKET)
+               return -EINVAL;
+
+       pkt_buf = kzalloc(pkt_len, GFP_KERNEL);
+       msk_buf = kzalloc(pkt_len, GFP_KERNEL);
+
        if (!pkt_buf || !msk_buf)
                goto err_mem_alloc;
 
-       memcpy(pkt_buf, proto->raw.spec, proto->raw.pkt_len);
-       memcpy(msk_buf, proto->raw.mask, proto->raw.pkt_len);
+       memcpy(pkt_buf, proto->raw.spec, pkt_len);
+       memcpy(msk_buf, proto->raw.mask, pkt_len);
 
        hw = &pf->hw;
 
@@ -862,7 +871,7 @@ ice_vc_fdir_parse_raw(struct ice_vf *vf,
        if (ice_get_open_tunnel_port(hw, &udp_port, TNL_VXLAN))
                ice_parser_vxlan_tunnel_set(psr, udp_port, true);
 
-       status = ice_parser_run(psr, pkt_buf, proto->raw.pkt_len, &rslt);
+       status = ice_parser_run(psr, pkt_buf, pkt_len, &rslt);
        if (status)
                goto err_parser_destroy;
 
@@ -876,7 +885,7 @@ ice_vc_fdir_parse_raw(struct ice_vf *vf,
        }
 
        status = ice_parser_profile_init(&rslt, pkt_buf, msk_buf,
-                                        proto->raw.pkt_len, ICE_BLK_FD,
+                                        pkt_len, ICE_BLK_FD,
                                         conf->prof);
        if (status)
                goto err_parser_profile_init;
@@ -885,7 +894,7 @@ ice_vc_fdir_parse_raw(struct ice_vf *vf,
                ice_parser_profile_dump(hw, conf->prof);
 
        /* Store raw flow info into @conf */
-       conf->pkt_len = proto->raw.pkt_len;
+       conf->pkt_len = pkt_len;
        conf->pkt_buf = pkt_buf;
        conf->parser_ena = true;
 
-- 
2.47.0