From nobody Sun May 24 22:35:55 2026 Received: from mail-qk1-f174.google.com (mail-qk1-f174.google.com [209.85.222.174]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 899293F23CC for ; Wed, 20 May 2026 15:42:10 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.222.174 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1779291732; cv=none; b=ppOhq6B5oLCwSzl3BZF1r75whBXhZIB+z1E9Z2+p21YRkUb0BlNqRHvne71Ieu8cBCpTlhVRP8Cap0S1Qj3lWy4qOLrWsIUyWHHbyO/1GjGet2fxDmFsGW3Z1ho8+e6djkWlcop1sPNV8bKvYh5wFhg1UwLjJdROprdBwvihbIE= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1779291732; c=relaxed/simple; bh=37tRhAbzNX+kAG/Kxdlit0C6n0x+AotN1s2VBCP2iIg=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=NpmX3ScNJyCLDq1Ph1OYHqYYMV9XRaAPon1Kvlgy7qji+h/7qk2VQZFBw7iPHFBYFZ0N/Be0xdVVLaPk3nn3xzMqvj+IJa9mdoj0rj4om9AaZl0s4SJLhAl8b3BaoLydN9seTTp97gt8fAPyHl921J3/X9/WK6Wf90FCYLBX+lY= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=Rgo6JmeZ; arc=none smtp.client-ip=209.85.222.174 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="Rgo6JmeZ" Received: by mail-qk1-f174.google.com with SMTP id af79cd13be357-9125d2a4d36so344617085a.3 for ; Wed, 20 May 2026 08:42:10 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1779291729; x=1779896529; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to; bh=SeZT6mkI2EJo8NQ3oGxuCkgFQyJx2pM/KNG1eLQDLLA=; b=Rgo6JmeZd8INqzx00YGbSmeYGls7JesTG3H5b48qm/qk+R3O53sjDenC+nxHpqu/w6 5zw/i594zdMb/o6PJV9RjJaMGidPsiA8qs0aEAhO1Om8QwUZ4JAjuvemx3SQFt1EYugX A56kuU9fzmeSnITOGDTuJL1wePHu5DZbz5F2wgBGqtIxRNKJEfDtZqqjJuB5jrAI46qD 4B4+PpGoPIxW3PiyYwQfkbLW0n1hR8BDNqm49dvQLG2OaWujMXgj2KC9IPDyWxM4FwmN np8dCDS2XqUN2xICrYcHgwk5FmNa7bQh0KLjzplFw7Qlp0bOCo22NTHl5y+bOPgF++xZ SxOg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1779291729; x=1779896529; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to; bh=SeZT6mkI2EJo8NQ3oGxuCkgFQyJx2pM/KNG1eLQDLLA=; b=shtJwhtVN7U8BVRHO/xHP8qVU3mvCzyAtPHZ2PgW6c3k8HKmSBsDh2SJXdtsFOwzBx EqJYjXkpFYMlJeEpyC/pZ4EC15rOTYnK6VvS0LnVnkRhD5CmIMjxxQHUmsfi9CjEMDpA Pox5InRZLp5v7DIw9gBiFec4dOVci8BnIXykIPzE4PgpB9RPFjpqgFVjep4NmlR7H4kS BiTbFVQFXvblegz+EwF01DzLzC9CxdP/NfszY8FRixLPhyUHOMcalPqSFL1BaCf6W7id RXSXqAoO1fM4qmCEUISSuOS5nujPyBSjaJ7skV1/UPhWDa0+nYZYx+FOYYvFC80oTpg7 DEcQ== X-Forwarded-Encrypted: i=1; AFNElJ8QQnbqyVe8R1wm/EK+d/cnK/HhiO2C48qmD4bErzym4n27Lucc5+3jyMzQ20NSYC7MEAuu/iYUgqFnVio=@vger.kernel.org X-Gm-Message-State: AOJu0YwAkgmWK1dyr+Xu9+vVoNlWNf0jUbC1/Rk5OqBAgscp/xZD9pWs NceYFre0BZfpAmkGpbc/xNLJYWADIxbu8Uub3PdVb/kA1cyf/dPhC14w X-Gm-Gg: Acq92OHIdVZNrlssu6bZGlLc4PiiphA/abmOqar6/y6MdgQwq09ThgG0EmLf3BWGnCT Qu1HFMwPgIdxUH33uLwvodBC0nqaqH44U8hvz752dcObLgGjTPovhlgTyB2ekVLUnKY1hUX+4u9 Qa+GIoBiBDFPojrZoI7xAlmXsNdFVXpEuv4yBSDu+kYiE4f/jd0ssNg9gh3U+txRimhisiOMwnZ AysKt3UIjYv9P4aPjZO6/KNvAyFkpy7wKeTZk52EaoLgCP3GwBycc+cYifdq9KOHDiM47DiHVgV xq4dEtcNZq4uFCBiL91Q9Yd3h76UB1dfXADeSc8Ud/XbW++jCQY5Tqf7je4B42JsXzmyCfTPSfx 9kK5IzYh1/INEsONcOMfq94a+YU84H1qjt12MsR1eiPWJe7NlC7KlBAk4h72OwEiJDQwMjSVEM2 7TkzFtn/QoPqxZlrrkEQyNlHCDt1yHl8wytC8hjqCSCdWuzwi22PwkxB4MBCAOeO1FMjwFKNGN/ 9ZepbSOo72ZW5i6ebn7 X-Received: by 2002:a05:620a:c43:b0:90f:624d:70d3 with SMTP id af79cd13be357-911cdd41abcmr3774519585a.23.1779291729177; Wed, 20 May 2026 08:42:09 -0700 (PDT) Received: from server0 (c-68-48-65-54.hsd1.mi.comcast.net. [68.48.65.54]) by smtp.gmail.com with ESMTPSA id af79cd13be357-910bc83b85asm2167221685a.25.2026.05.20.08.42.08 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 20 May 2026 08:42:08 -0700 (PDT) From: Michael Bommarito To: Sunil Goutham , Linu Cherian , Geetha sowjanya , hariprasad , Subbaraya Sundeep , Andrew Lunn , "David S . Miller" , Eric Dumazet , Jakub Kicinski , Paolo Abeni Cc: netdev@vger.kernel.org, linux-kernel@vger.kernel.org Subject: [PATCH net] octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify Date: Wed, 20 May 2026 11:41:57 -0400 Message-ID: <20260520154157.1439319-1-michael.bommarito@gmail.com> X-Mailer: git-send-email 2.53.0 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" rvu_mbox_handler_rep_event_notify() in drivers/net/ethernet/marvell/ octeontx2/af/rvu_rep.c queues a sender-controlled REP_EVENT_NOTIFY request body verbatim, and rvu_rep_up_notify() then forwards event->pcifunc (the nested body field, distinct from the AF-normalised header pcifunc) into rvu_get_pfvf(), rvu_get_pf() and the AF->PF mailbox device index without any bounds check. A VF attached to a PF that has been put into switchdev representor mode reaches this path: the VF mailbox handler otx2_pfvf_mbox_handler() forwards every message id including MBOX_MSG_REP_EVENT_NOTIFY to AF without an allowlist, and the AF dispatcher rewrites only msg->pcifunc, leaving struct rep_event::pcifunc attacker-controlled. The sibling rvu_mbox_handler_esw_cfg() refuses requests whose header pcifunc is not rvu->rep_pcifunc; this handler has no equivalent gate. An out-of-range body pcifunc selects an &rvu->pf[]/&rvu->hwvf[] element past the allocated array and, for RVU_EVENT_MAC_ADDR_CHANGE, turns into a six-byte attacker-chosen OOB ether_addr_copy() target inside the queued worker; KASAN reports a slab-out-of-bounds write in rvu_rep_wq_handler. Reject malformed requests at the handler entry by gating on is_pf_func_valid(), which is already the canonical PF/VF range check in this driver; expose it via rvu.h so callers in rvu_rep.c can use it instead of open-coding the same range arithmetic. Fixes: b8fea84a0468 ("octeontx2-pf: Add support to sync link state between = representor and VFs") Cc: stable@vger.kernel.org Assisted-by: Claude:claude-opus-4-7 Signed-off-by: Michael Bommarito --- Reproduction =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D Tree: net mainline at v7.1-rc4 (5200f5f493f7), x86_64 QEMU, CONFIG_KASAN_GENERIC=3Dy, CONFIG_KUNIT=3Dy, CONFIG_OCTEONTX2_AF=3Dy. Conditions: rvu_af bound to RVU AF hardware in production, or a synthetic struct rvu in the KUnit harness used for this report. No sysctl, capability, or namespace gate on the VF mailbox side once switchdev/SR-IOV is provisioned. Harness: an out-of-tree KUnit module invokes rvu_mbox_handler_rep_event_notify() directly on a synthetic struct rvu allocated via kunit_kzalloc with a one-PF rvu->pf[] array and rvu->hw->total_pfs =3D=3D 1. The crafted struct rep_event sets hdr.sig =3D OTX2_MBOX_REQ_SIG, hdr.id =3D MBOX_MSG_REP_EVENT_NOTIFY, header pcifunc 0, nested body pcifunc 2 << RVU_OTX2_PFVF_PF_SHIFT (one PF past the synthetic array), event =3D RVU_EVENT_MAC_ADDR_CHANGE, and a six-byte payload. This matches the bytes a forwarded VF mailbox message places at the AF mbox. Stock: BUG: KASAN: slab-out-of-bounds in rvu_rep_wq_handler+0x100/0x280 Write of size 4 at addr ffff8880022bff03 by task kworker/0:0/9 Workqueue: rep_evt_kunit_wq rvu_rep_wq_handler allocated by kunit_kmalloc_array+0x1b/0x50 -> make_synth_rvu Patched: same harness, KASAN silent, the handler returns -EINVAL at the new gate and never queues the entry; KUnit reports "ok 1 otx2_rep_event_pcifunc_oob_demux_mac". Regression: legitimate body pcifunc inside [0, total_pfs) is unchanged in behaviour and continues to queue and execute on the same code path; the gate only fires on out-of-range selectors. Mitigations: none on the VF mailbox path. Operators who do not provision SR-IOV VFs in switchdev representor mode are not exposed. The KUnit harness module is held off-list and is available on maintainer request. drivers/net/ethernet/marvell/octeontx2/af/rvu.c | 2 +- drivers/net/ethernet/marvell/octeontx2/af/rvu.h | 1 + drivers/net/ethernet/marvell/octeontx2/af/rvu_rep.c | 8 ++++++++ 3 files changed, 10 insertions(+), 1 deletion(-) diff --git a/drivers/net/ethernet/marvell/octeontx2/af/rvu.c b/drivers/net/= ethernet/marvell/octeontx2/af/rvu.c index e40b79076358d..3cf131508ecfe 100644 --- a/drivers/net/ethernet/marvell/octeontx2/af/rvu.c +++ b/drivers/net/ethernet/marvell/octeontx2/af/rvu.c @@ -436,7 +436,7 @@ struct rvu_pfvf *rvu_get_pfvf(struct rvu *rvu, int pcif= unc) return &rvu->pf[rvu_get_pf(rvu->pdev, pcifunc)]; } =20 -static bool is_pf_func_valid(struct rvu *rvu, u16 pcifunc) +bool is_pf_func_valid(struct rvu *rvu, u16 pcifunc) { int pf, vf, nvfs; u64 cfg; diff --git a/drivers/net/ethernet/marvell/octeontx2/af/rvu.h b/drivers/net/= ethernet/marvell/octeontx2/af/rvu.h index a466181cf9082..de3fbd3d15d60 100644 --- a/drivers/net/ethernet/marvell/octeontx2/af/rvu.h +++ b/drivers/net/ethernet/marvell/octeontx2/af/rvu.h @@ -917,6 +917,7 @@ u16 rvu_get_rsrc_mapcount(struct rvu_pfvf *pfvf, int bl= kaddr); struct rvu_pfvf *rvu_get_pfvf(struct rvu *rvu, int pcifunc); void rvu_get_pf_numvfs(struct rvu *rvu, int pf, int *numvfs, int *hwvf); bool is_block_implemented(struct rvu_hwinfo *hw, int blkaddr); +bool is_pf_func_valid(struct rvu *rvu, u16 pcifunc); bool is_pffunc_map_valid(struct rvu *rvu, u16 pcifunc, int blktype); int rvu_get_lf(struct rvu *rvu, struct rvu_block *block, u16 pcifunc, u16 = slot); int rvu_lf_reset(struct rvu *rvu, struct rvu_block *block, int lf); diff --git a/drivers/net/ethernet/marvell/octeontx2/af/rvu_rep.c b/drivers/= net/ethernet/marvell/octeontx2/af/rvu_rep.c index 901f6fd40fd49..a2781e0f504e3 100644 --- a/drivers/net/ethernet/marvell/octeontx2/af/rvu_rep.c +++ b/drivers/net/ethernet/marvell/octeontx2/af/rvu_rep.c @@ -97,6 +97,14 @@ int rvu_mbox_handler_rep_event_notify(struct rvu *rvu, s= truct rep_event *req, { struct rep_evtq_ent *qentry; =20 + /* The mailbox dispatcher normalises only the header pcifunc; the + * nested struct rep_event::pcifunc body field is sender-controlled + * and is later used by rvu_rep_up_notify() to index rvu->pf[] / + * rvu->hwvf[]. Reject out-of-range body selectors before queueing. + */ + if (!is_pf_func_valid(rvu, req->pcifunc)) + return -EINVAL; + qentry =3D kmalloc_obj(*qentry, GFP_ATOMIC); if (!qentry) return -ENOMEM; base-commit: 5200f5f493f79f14bbdc349e402a40dfb32f23c8 --=20 2.53.0