]> git.itanic.dy.fi Git - linux-stable/commit
net/mlx5: DR, Fix slab-out-of-bounds in mlx5_cmd_dr_create_fte
authorYevgeny Kliteynik <kliteyn@nvidia.com>
Tue, 11 Jan 2022 01:00:03 +0000 (03:00 +0200)
committerSaeed Mahameed <saeedm@nvidia.com>
Thu, 24 Feb 2022 00:08:10 +0000 (16:08 -0800)
commit0aec12d97b2036af0946e3d582144739860ac07b
treec9cce06a9dc1672322f081e30341bc8ee0203e42
parente5b2bc30c21139ae10f0e56989389d0bc7b7b1d6
net/mlx5: DR, Fix slab-out-of-bounds in mlx5_cmd_dr_create_fte

When adding a rule with 32 destinations, we hit the following out-of-band
access issue:

  BUG: KASAN: slab-out-of-bounds in mlx5_cmd_dr_create_fte+0x18ee/0x1e70

This patch fixes the issue by both increasing the allocated buffers to
accommodate for the needed actions and by checking the number of actions
to prevent this issue when a rule with too many actions is provided.

Fixes: 1ffd498901c1 ("net/mlx5: DR, Increase supported num of actions to 32")
Signed-off-by: Yevgeny Kliteynik <kliteyn@nvidia.com>
Reviewed-by: Alex Vesker <valex@nvidia.com>
Signed-off-by: Saeed Mahameed <saeedm@nvidia.com>
drivers/net/ethernet/mellanox/mlx5/core/steering/fs_dr.c