i40e: add validation for ring_len param

commit 55d225670def06b01af2e7a5e0446fbe946289e8 upstream.

The `ring_len` parameter provided by the virtual function (VF)
is assigned directly to the hardware memory context (HMC) without
any validation.

To address this, introduce an upper boundary check for both Tx and Rx
queue lengths. The maximum number of descriptors supported by the
hardware is 8k-32.
Additionally, enforce alignment constraints: Tx rings must be a multiple
of 8, and Rx rings must be a multiple of 32.

Fixes: 5c3c48ac6bf5 ("i40e: implement virtual device interface")
Cc: stable@vger.kernel.org
Signed-off-by: Lukasz Czapnik <lukasz.czapnik@intel.com>
Reviewed-by: Aleksandr Loktionov <aleksandr.loktionov@intel.com>
Signed-off-by: Przemek Kitszel <przemyslaw.kitszel@intel.com>
Reviewed-by: Simon Horman <horms@kernel.org>
Tested-by: Rafal Romanowski <rafal.romanowski@intel.com>
Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

diff --git a/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c b/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c
index 7ccfc1191ae56f0524afd658194443cdb602ee2a..482b935fc937f2d99de948ec677260cde92f6113 100644 (file)
--- a/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c
+++ b/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c
@@ -653,6 +653,13 @@ static int i40e_config_vsi_tx_queue(struct i40e_vf *vf, u16 vsi_id,
 
        /* only set the required fields */
        tx_ctx.base = info->dma_ring_addr / 128;
+
+       /* ring_len has to be multiple of 8 */
+       if (!IS_ALIGNED(info->ring_len, 8) ||
+           info->ring_len > I40E_MAX_NUM_DESCRIPTORS_XL710) {
+               ret = -EINVAL;
+               goto error_context;
+       }
        tx_ctx.qlen = info->ring_len;
        tx_ctx.rdylist = le16_to_cpu(vsi->info.qs_handle[0]);
        tx_ctx.rdylist_act = 0;
@@ -716,6 +723,13 @@ static int i40e_config_vsi_rx_queue(struct i40e_vf *vf, u16 vsi_id,
 
        /* only set the required fields */
        rx_ctx.base = info->dma_ring_addr / 128;
+
+       /* ring_len has to be multiple of 32 */
+       if (!IS_ALIGNED(info->ring_len, 32) ||
+           info->ring_len > I40E_MAX_NUM_DESCRIPTORS_XL710) {
+               ret = -EINVAL;
+               goto error_param;
+       }
        rx_ctx.qlen = info->ring_len;
 
        if (info->splithdr_enabled) {