tjh.dev / kernel
Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux
1
fork

Configure Feed

Select the types of activity you want to include in your feed.

net: mana: Use at least SZ_4K in doorbell ID range check

mana_gd_ring_doorbell() accesses offsets up to DOORBELL_OFFSET_EQ
(0xFF8) + 8 bytes = 4KB within each doorbell page. A db_page_size
smaller than SZ_4K is fundamentally incompatible with the driver:
doorbell pages would overlap and the device cannot function correctly.

Validate db_page_size at the source and fail the
probe early if the value is below SZ_4K. This ensures the doorbell ID
range check in mana_gd_register_device() can rely on db_page_size
being valid.

Fixes: 89fe91c65992 ("net: mana: hardening: Validate doorbell ID from GDMA_REGISTER_DEVICE response")
Signed-off-by: Erni Sri Satya Vennela <ernis@linux.microsoft.com>
Reviewed-by: Simon Horman <horms@kernel.org>
Link: https://patch.msgid.link/20260325180423.1923060-1-ernis@linux.microsoft.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>

authored by

Erni Sri Satya Vennela and committed by
Jakub Kicinski fb4b4a05 b8f9410a

+25
+25
drivers/net/ethernet/microsoft/mana/gdma_main.c
··· 4 4 #include <linux/debugfs.h> 5 5 #include <linux/module.h> 6 6 #include <linux/pci.h> 7 + #include <linux/sizes.h> 7 8 #include <linux/utsname.h> 8 9 #include <linux/version.h> 9 10 #include <linux/msi.h> ··· 47 46 u64 sriov_base_off; 48 47 49 48 gc->db_page_size = mana_gd_r32(gc, GDMA_PF_REG_DB_PAGE_SIZE) & 0xFFFF; 49 + 50 + /* mana_gd_ring_doorbell() accesses offsets up to DOORBELL_OFFSET_EQ 51 + * (0xFF8) + 8 bytes = 4KB within each doorbell page, so the page 52 + * size must be at least SZ_4K. 53 + */ 54 + if (gc->db_page_size < SZ_4K) { 55 + dev_err(gc->dev, 56 + "Doorbell page size %llu too small (min %u)\n", 57 + gc->db_page_size, SZ_4K); 58 + return -EPROTO; 59 + } 60 + 50 61 gc->db_page_off = mana_gd_r64(gc, GDMA_PF_REG_DB_PAGE_OFF); 51 62 52 63 /* Validate doorbell offset is within BAR0 */ ··· 86 73 struct gdma_context *gc = pci_get_drvdata(pdev); 87 74 88 75 gc->db_page_size = mana_gd_r32(gc, GDMA_REG_DB_PAGE_SIZE) & 0xFFFF; 76 + 77 + /* mana_gd_ring_doorbell() accesses offsets up to DOORBELL_OFFSET_EQ 78 + * (0xFF8) + 8 bytes = 4KB within each doorbell page, so the page 79 + * size must be at least SZ_4K. 80 + */ 81 + if (gc->db_page_size < SZ_4K) { 82 + dev_err(gc->dev, 83 + "Doorbell page size %llu too small (min %u)\n", 84 + gc->db_page_size, SZ_4K); 85 + return -EPROTO; 86 + } 87 + 89 88 gc->db_page_off = mana_gd_r64(gc, GDMA_REG_DB_PAGE_OFFSET); 90 89 91 90 /* Validate doorbell offset is within BAR0 */