Dan Carpenter 096f1ebc46 net: rtnetlink: prevent underflows in do_setvfinfo() ... [ Upstream commit d658c8f56ec7b3de8051a24afb25da9ba3c388c5 ] The "ivm->vf" variable is a u32, but the problem is that a number of drivers cast it to an int and then forget to check for negatives. An example of this is in the cxgb4 driver. drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c 2890 static int cxgb4_mgmt_get_vf_config(struct net_device *dev, 2891 int vf, struct ifla_vf_info *ivi) ^^^^^^ 2892 { 2893 struct port_info *pi = netdev_priv(dev); 2894 struct adapter *adap = pi->adapter; 2895 struct vf_info *vfinfo; 2896 2897 if (vf >= adap->num_vfs) ^^^^^^^^^^^^^^^^^^^ 2898 return -EINVAL; 2899 vfinfo = &adap->vfinfo[vf]; ^^^^^^^^^^^^^^^^^^^^^^^^^^ There are 48 functions affected. drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c:8435 hclge_set_vf_vlan_filter() warn: can 'vfid' underflow 's32min-2147483646' drivers/net/ethernet/freescale/enetc/enetc_pf.c:377 enetc_pf_set_vf_mac() warn: can 'vf' underflow 's32min-2147483646' drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c:2899 cxgb4_mgmt_get_vf_config() warn: can 'vf' underflow 's32min-254' drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c:2960 cxgb4_mgmt_set_vf_rate() warn: can 'vf' underflow 's32min-254' drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c:3019 cxgb4_mgmt_set_vf_rate() warn: can 'vf' underflow 's32min-254' drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c:3038 cxgb4_mgmt_set_vf_vlan() warn: can 'vf' underflow 's32min-254' drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c:3086 cxgb4_mgmt_set_vf_link_state() warn: can 'vf' underflow 's32min-254' drivers/net/ethernet/chelsio/cxgb/cxgb2.c:791 get_eeprom() warn: can 'i' underflow 's32min-(-4),0,4-s32max' drivers/net/ethernet/broadcom/bnxt/bnxt_sriov.c:82 bnxt_set_vf_spoofchk() warn: can 'vf_id' underflow 's32min-65534' drivers/net/ethernet/broadcom/bnxt/bnxt_sriov.c:164 bnxt_set_vf_trust() warn: can 'vf_id' underflow 's32min-65534' drivers/net/ethernet/broadcom/bnxt/bnxt_sriov.c:186 bnxt_get_vf_config() warn: can 'vf_id' underflow 's32min-65534' drivers/net/ethernet/broadcom/bnxt/bnxt_sriov.c:228 bnxt_set_vf_mac() warn: can 'vf_id' underflow 's32min-65534' drivers/net/ethernet/broadcom/bnxt/bnxt_sriov.c:264 bnxt_set_vf_vlan() warn: can 'vf_id' underflow 's32min-65534' drivers/net/ethernet/broadcom/bnxt/bnxt_sriov.c:293 bnxt_set_vf_bw() warn: can 'vf_id' underflow 's32min-65534' drivers/net/ethernet/broadcom/bnxt/bnxt_sriov.c:333 bnxt_set_vf_link_state() warn: can 'vf_id' underflow 's32min-65534' drivers/net/ethernet/broadcom/bnx2x/bnx2x_sriov.c:2595 bnx2x_vf_op_prep() warn: can 'vfidx' underflow 's32min-63' drivers/net/ethernet/broadcom/bnx2x/bnx2x_sriov.c:2595 bnx2x_vf_op_prep() warn: can 'vfidx' underflow 's32min-63' drivers/net/ethernet/broadcom/bnx2x/bnx2x_vfpf.c:2281 bnx2x_post_vf_bulletin() warn: can 'vf' underflow 's32min-63' drivers/net/ethernet/broadcom/bnx2x/bnx2x_vfpf.c:2285 bnx2x_post_vf_bulletin() warn: can 'vf' underflow 's32min-63' drivers/net/ethernet/broadcom/bnx2x/bnx2x_vfpf.c:2286 bnx2x_post_vf_bulletin() warn: can 'vf' underflow 's32min-63' drivers/net/ethernet/broadcom/bnx2x/bnx2x_vfpf.c:2292 bnx2x_post_vf_bulletin() warn: can 'vf' underflow 's32min-63' drivers/net/ethernet/broadcom/bnx2x/bnx2x_vfpf.c:2297 bnx2x_post_vf_bulletin() warn: can 'vf' underflow 's32min-63' drivers/net/ethernet/qlogic/qlcnic/qlcnic_sriov_pf.c:1832 qlcnic_sriov_set_vf_mac() warn: can 'vf' underflow 's32min-254' drivers/net/ethernet/qlogic/qlcnic/qlcnic_sriov_pf.c:1864 qlcnic_sriov_set_vf_tx_rate() warn: can 'vf' underflow 's32min-254' drivers/net/ethernet/qlogic/qlcnic/qlcnic_sriov_pf.c:1937 qlcnic_sriov_set_vf_vlan() warn: can 'vf' underflow 's32min-254' drivers/net/ethernet/qlogic/qlcnic/qlcnic_sriov_pf.c:2005 qlcnic_sriov_get_vf_config() warn: can 'vf' underflow 's32min-254' drivers/net/ethernet/qlogic/qlcnic/qlcnic_sriov_pf.c:2036 qlcnic_sriov_set_vf_spoofchk() warn: can 'vf' underflow 's32min-254' drivers/net/ethernet/emulex/benet/be_main.c:1914 be_get_vf_config() warn: can 'vf' underflow 's32min-65534' drivers/net/ethernet/emulex/benet/be_main.c:1915 be_get_vf_config() warn: can 'vf' underflow 's32min-65534' drivers/net/ethernet/emulex/benet/be_main.c:1922 be_set_vf_tvt() warn: can 'vf' underflow 's32min-65534' drivers/net/ethernet/emulex/benet/be_main.c:1951 be_clear_vf_tvt() warn: can 'vf' underflow 's32min-65534' drivers/net/ethernet/emulex/benet/be_main.c:2063 be_set_vf_tx_rate() warn: can 'vf' underflow 's32min-65534' drivers/net/ethernet/emulex/benet/be_main.c:2091 be_set_vf_link_state() warn: can 'vf' underflow 's32min-65534' drivers/net/ethernet/intel/ice/ice_virtchnl_pf.c:2609 ice_set_vf_port_vlan() warn: can 'vf_id' underflow 's32min-65534' drivers/net/ethernet/intel/ice/ice_virtchnl_pf.c:3050 ice_get_vf_cfg() warn: can 'vf_id' underflow 's32min-65534' drivers/net/ethernet/intel/ice/ice_virtchnl_pf.c:3103 ice_set_vf_spoofchk() warn: can 'vf_id' underflow 's32min-65534' drivers/net/ethernet/intel/ice/ice_virtchnl_pf.c:3181 ice_set_vf_mac() warn: can 'vf_id' underflow 's32min-65534' drivers/net/ethernet/intel/ice/ice_virtchnl_pf.c:3237 ice_set_vf_trust() warn: can 'vf_id' underflow 's32min-65534' drivers/net/ethernet/intel/ice/ice_virtchnl_pf.c:3286 ice_set_vf_link_state() warn: can 'vf_id' underflow 's32min-65534' drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c:3919 i40e_validate_vf() warn: can 'vf_id' underflow 's32min-2147483646' drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c:3957 i40e_ndo_set_vf_mac() warn: can 'vf_id' underflow 's32min-2147483646' drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c:4104 i40e_ndo_set_vf_port_vlan() warn: can 'vf_id' underflow 's32min-2147483646' drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c:4263 i40e_ndo_set_vf_bw() warn: can 'vf_id' underflow 's32min-2147483646' drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c:4309 i40e_ndo_get_vf_config() warn: can 'vf_id' underflow 's32min-2147483646' drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c:4371 i40e_ndo_set_vf_link_state() warn: can 'vf_id' underflow 's32min-2147483646' drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c:4441 i40e_ndo_set_vf_spoofchk() warn: can 'vf_id' underflow 's32min-2147483646' drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c:4441 i40e_ndo_set_vf_spoofchk() warn: can 'vf_id' underflow 's32min-2147483646' drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c:4504 i40e_ndo_set_vf_trust() warn: can 'vf_id' underflow 's32min-2147483646' Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>		2019-11-28 18:25:26 +01:00
..
6lowpan
9p	9p/virtio: Add cleanup path in p9_virtio_init	2019-08-04 09:34:51 +02:00
802
8021q	vlan: disable SIOCSHWTSTAMP in container	2019-05-16 19:45:17 +02:00
appletalk	appletalk: enforce CAP_NET_RAW for raw sockets	2019-10-05 12:27:43 +02:00
atm	net: atm: Fix potential Spectre v1 vulnerabilities	2019-04-27 09:33:59 +02:00
ax25	ax25: enforce CAP_NET_RAW for raw sockets	2019-10-05 12:27:43 +02:00
batman-adv	batman-adv: fix for leaked TVLV handler.	2019-08-04 09:34:39 +02:00
bluetooth	Bluetooth: L2CAP: Detect if remote is not able to use the whole MPS	2019-11-25 15:54:16 +01:00
bridge	bridge/mdb: remove wrong use of NLM_F_MULTI	2019-09-21 07:12:37 +02:00
caif
can	can: purge socket error queue on sock destruct	2019-07-10 09:56:33 +02:00
ceph	libceph: handle an empty authorize reply	2019-03-23 08:44:18 +01:00
core	net: rtnetlink: prevent underflows in do_setvfinfo()	2019-11-28 18:25:26 +01:00
dcb
dccp	inet: stop leaking jiffies on the wire	2019-11-10 11:21:13 +01:00
decnet
dns_resolver
dsa	net: dsa: slave: Don't propagate flag changes on down slave interfaces	2019-02-20 10:13:15 +01:00
ethernet
hsr	net/hsr: fix possible crash in add_timer()	2019-03-23 08:44:31 +01:00
ieee802154	ieee802154: enforce CAP_NET_RAW for raw sockets	2019-10-05 12:27:43 +02:00
ipv4	inet: stop leaking jiffies on the wire	2019-11-10 11:21:13 +01:00
ipv6	ipv6: drop incoming packets having a v4mapped source address	2019-10-07 21:01:04 +02:00
ipx
irda
iucv
key	xfrm: clean up xfrm protocol checks	2019-09-16 08:13:35 +02:00
l2tp	compat_ioctl: pppoe: fix PPPOEIOCSFWD handling	2019-08-11 12:20:46 +02:00
l3mdev
lapb	lapb: fixed leak of control-blocks.	2019-06-22 08:18:25 +02:00
llc	llc: avoid blocking in llc_sap_close()	2019-11-25 15:53:57 +01:00
mac80211	mac80211: minstrel: fix CCK rate group streams value	2019-11-25 15:54:51 +01:00
mac802154
mpls
netfilter	ipvs: move old_secure_tcp into struct netns_ipvs	2019-11-12 19:13:26 +01:00
netlabel
netlink
netrom	netrom: hold sock when setting skb->destructor	2019-08-04 09:34:54 +02:00
nfc	nfc: netlink: fix double device reference drop	2019-11-12 19:13:17 +01:00
openvswitch	net: ovs: fix return type of ndo_start_xmit function	2019-11-25 15:54:27 +01:00
packet	af_packet: tone down the Tx-ring unsupported spew.	2019-09-16 08:13:36 +02:00
phonet	phonet: fix building with clang	2019-03-23 08:44:34 +01:00
rds	net/rds: Fix error handling in rds_ib_add_one()	2019-10-07 21:01:06 +02:00
rfkill
rose	net: rose: fix a possible stack overflow	2019-04-03 06:23:25 +02:00
rxrpc
sched	net/sched: act_pedit: fix WARN() in the traffic path	2019-11-28 18:25:26 +01:00
sctp	inet: stop leaking jiffies on the wire	2019-11-10 11:21:13 +01:00
sunrpc	SUNRPC: Fix priority queue fairness	2019-11-25 15:54:28 +01:00
switchdev
tipc	tipc: add NULL pointer check before calling kfree_rcu	2019-09-21 07:12:41 +02:00
unix	missing barriers in some of unix_sock ->addr and ->path accesses	2019-03-23 08:44:31 +01:00
vmw_vsock	vsock: cope with memory allocation failure at socket creation time	2019-02-23 09:05:13 +01:00
wimax
wireless	nl80211: Fix a GET_KEY reply attribute	2019-11-25 15:54:30 +01:00
x25	net/x25: fix a race in x25_bind()	2019-03-23 08:44:30 +01:00
xfrm	xfrm: clean up xfrm protocol checks	2019-09-16 08:13:35 +02:00
compat.c	sock: Make sock->sk_stamp thread-safe	2019-01-13 10:05:28 +01:00
Kconfig
Makefile
socket.c	sockfs: getxattr: Fail with -EOPNOTSUPP for invalid attribute names	2019-03-23 08:44:21 +01:00
sysctl_net.c