mirrors/linux
2
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git synced 2026-05-16 06:41:39 -04:00
Code Issues Packages Projects Releases Wiki Activity

net: mana: Use at least SZ_4K in doorbell ID range check

Browse Source 
mana_gd_ring_doorbell() accesses offsets up to DOORBELL_OFFSET_EQ
(0xFF8) + 8 bytes = 4KB within each doorbell page. A db_page_size
smaller than SZ_4K is fundamentally incompatible with the driver:
doorbell pages would overlap and the device cannot function correctly.

Validate db_page_size at the source and fail the
probe early if the value is below SZ_4K. This ensures the doorbell ID
range check in mana_gd_register_device() can rely on db_page_size
being valid.

Fixes: 89fe91c659 ("net: mana: hardening: Validate doorbell ID from GDMA_REGISTER_DEVICE response")
Signed-off-by: Erni Sri Satya Vennela <ernis@linux.microsoft.com>
Reviewed-by: Simon Horman <horms@kernel.org>
Link: https://patch.msgid.link/20260325180423.1923060-1-ernis@linux.microsoft.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
This commit is contained in:
Erni Sri Satya Vennela
2026-03-25 11:04:17 -07:00
committed by Jakub Kicinski
parent b8f9410aef
commit fb4b4a05ae
1 changed files with 25 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

25
drivers/net/ethernet/microsoft/mana/gdma_main.c
View File

@@ -4,6 +4,7 @@
#include <linux/debugfs.h>
#include <linux/module.h>
#include <linux/pci.h>
#include <linux/sizes.h>
#include <linux/utsname.h>
#include <linux/version.h>
#include <linux/msi.h>
@@ -46,6 +47,18 @@ static int mana_gd_init_pf_regs(struct pci_dev *pdev)
u64 sriov_base_off;
gc->db_page_size = mana_gd_r32(gc, GDMA_PF_REG_DB_PAGE_SIZE) & 0xFFFF;
/* mana_gd_ring_doorbell() accesses offsets up to DOORBELL_OFFSET_EQ
* (0xFF8) + 8 bytes = 4KB within each doorbell page, so the page
* size must be at least SZ_4K.
*/
if (gc->db_page_size < SZ_4K) {
dev_err(gc->dev,
"Doorbell page size %llu too small (min %u)\n",
gc->db_page_size, SZ_4K);
return -EPROTO;
}
gc->db_page_off = mana_gd_r64(gc, GDMA_PF_REG_DB_PAGE_OFF);
/* Validate doorbell offset is within BAR0 */
@@ -73,6 +86,18 @@ static int mana_gd_init_vf_regs(struct pci_dev *pdev)
struct gdma_context *gc = pci_get_drvdata(pdev);
gc->db_page_size = mana_gd_r32(gc, GDMA_REG_DB_PAGE_SIZE) & 0xFFFF;
/* mana_gd_ring_doorbell() accesses offsets up to DOORBELL_OFFSET_EQ
* (0xFF8) + 8 bytes = 4KB within each doorbell page, so the page
* size must be at least SZ_4K.
*/
if (gc->db_page_size < SZ_4K) {
dev_err(gc->dev,
"Doorbell page size %llu too small (min %u)\n",
gc->db_page_size, SZ_4K);
return -EPROTO;
}
gc->db_page_off = mana_gd_r64(gc, GDMA_REG_DB_PAGE_OFFSET);
/* Validate doorbell offset is within BAR0 */