{"id":2230077,"url":"http://patchwork.ozlabs.org/api/1.1/patches/2230077/?format=json","web_url":"http://patchwork.ozlabs.org/project/intel-wired-lan/patch/20260429074232.180528-1-larysa.zaremba@intel.com/","project":{"id":46,"url":"http://patchwork.ozlabs.org/api/1.1/projects/46/?format=json","name":"Intel Wired Ethernet development","link_name":"intel-wired-lan","list_id":"intel-wired-lan.osuosl.org","list_email":"intel-wired-lan@osuosl.org","web_url":"","scm_url":"","webscm_url":""},"msgid":"<20260429074232.180528-1-larysa.zaremba@intel.com>","date":"2026-04-29T07:42:30","name":"[iwl-net] idpf: fix RSS LUT memcpy size","commit_ref":null,"pull_url":null,"state":"new","archived":false,"hash":"c335df7fe5bb7fdc0639a0d9e9e8b90bce3fc927","submitter":{"id":84900,"url":"http://patchwork.ozlabs.org/api/1.1/people/84900/?format=json","name":"Larysa Zaremba","email":"larysa.zaremba@intel.com"},"delegate":null,"mbox":"http://patchwork.ozlabs.org/project/intel-wired-lan/patch/20260429074232.180528-1-larysa.zaremba@intel.com/mbox/","series":[{"id":502008,"url":"http://patchwork.ozlabs.org/api/1.1/series/502008/?format=json","web_url":"http://patchwork.ozlabs.org/project/intel-wired-lan/list/?series=502008","date":"2026-04-29T07:42:30","name":"[iwl-net] idpf: fix RSS LUT memcpy size","version":1,"mbox":"http://patchwork.ozlabs.org/series/502008/mbox/"}],"comments":"http://patchwork.ozlabs.org/api/patches/2230077/comments/","check":"pending","checks":"http://patchwork.ozlabs.org/api/patches/2230077/checks/","tags":{},"headers":{"Return-Path":"","X-Original-To":["incoming@patchwork.ozlabs.org","intel-wired-lan@lists.osuosl.org"],"Delivered-To":["patchwork-incoming@legolas.ozlabs.org","intel-wired-lan@lists.osuosl.org"],"Authentication-Results":["legolas.ozlabs.org;\n\tdkim=pass (2048-bit key;\n unprotected) header.d=osuosl.org header.i=@osuosl.org header.a=rsa-sha256\n header.s=default header.b=Lh0mEjJL;\n\tdkim-atps=neutral","legolas.ozlabs.org;\n spf=pass (sender SPF authorized) smtp.mailfrom=osuosl.org\n (client-ip=140.211.166.137; helo=smtp4.osuosl.org;\n envelope-from=intel-wired-lan-bounces@osuosl.org;\n receiver=patchwork.ozlabs.org)"],"Received":["from smtp4.osuosl.org (smtp4.osuosl.org [140.211.166.137])\n\t(using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)\n\t key-exchange x25519 server-signature ECDSA (secp384r1) server-digest SHA384)\n\t(No client certificate requested)\n\tby legolas.ozlabs.org (Postfix) with ESMTPS id 4g58R90hgGz1yHX\n\tfor ; Wed, 29 Apr 2026 17:42:44 +1000 (AEST)","from localhost (localhost [127.0.0.1])\n\tby smtp4.osuosl.org (Postfix) with ESMTP id E4AB442212;\n\tWed, 29 Apr 2026 07:42:42 +0000 (UTC)","from smtp4.osuosl.org ([127.0.0.1])\n by localhost (smtp4.osuosl.org [127.0.0.1]) (amavis, port 10024) with ESMTP\n id JlFOiJb60GWB; Wed, 29 Apr 2026 07:42:41 +0000 (UTC)","from lists1.osuosl.org (lists1.osuosl.org [140.211.166.142])\n\tby smtp4.osuosl.org (Postfix) with ESMTP id 6EEC14220D;\n\tWed, 29 Apr 2026 07:42:41 +0000 (UTC)","from smtp2.osuosl.org (smtp2.osuosl.org [IPv6:2605:bc80:3010::133])\n by lists1.osuosl.org (Postfix) with ESMTP id 3CAC01B8\n for ; Wed, 29 Apr 2026 07:42:40 +0000 (UTC)","from localhost (localhost [127.0.0.1])\n by smtp2.osuosl.org (Postfix) with ESMTP id 2137140AE7\n for ; Wed, 29 Apr 2026 07:42:40 +0000 (UTC)","from smtp2.osuosl.org ([127.0.0.1])\n by localhost (smtp2.osuosl.org [127.0.0.1]) (amavis, port 10024) with ESMTP\n id OT4A-Wo0krlq for ;\n Wed, 29 Apr 2026 07:42:39 +0000 (UTC)","from mgamail.intel.com (mgamail.intel.com [198.175.65.12])\n by smtp2.osuosl.org (Postfix) with ESMTPS id E033D4044A\n for ; Wed, 29 Apr 2026 07:42:38 +0000 (UTC)","from fmviesa004.fm.intel.com ([10.60.135.144])\n by orvoesa104.jf.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384;\n 29 Apr 2026 00:42:38 -0700","from irvmail002.ir.intel.com ([10.43.11.120])\n by fmviesa004.fm.intel.com with ESMTP; 29 Apr 2026 00:42:35 -0700","from mglak.igk.intel.com (mglak.igk.intel.com [10.237.112.146])\n by irvmail002.ir.intel.com (Postfix) with ESMTP id 0A62A27BA2;\n Wed, 29 Apr 2026 08:42:32 +0100 (IST)"],"X-Virus-Scanned":["amavis at osuosl.org","amavis at osuosl.org"],"X-Comment":"SPF check N/A for local connections - client-ip=140.211.166.142;\n helo=lists1.osuosl.org; envelope-from=intel-wired-lan-bounces@osuosl.org;\n receiver= ","DKIM-Filter":["OpenDKIM Filter v2.11.0 smtp4.osuosl.org 6EEC14220D","OpenDKIM Filter v2.11.0 smtp2.osuosl.org E033D4044A"],"DKIM-Signature":"v=1; a=rsa-sha256; c=relaxed/relaxed; d=osuosl.org;\n\ts=default; t=1777448561;\n\tbh=HhhqAOSf7r+oyqHVrybWEak9RazPKJT+nJg4pzZIXqM=;\n\th=From:To:Cc:Date:Subject:List-Id:List-Unsubscribe:List-Archive:\n\t List-Post:List-Help:List-Subscribe:From;\n\tb=Lh0mEjJL5DbDCO+ouGu8SO6dhpEQrZFlInTM2038eEQzhdlv7OPp6lpY0dlait2nA\n\t ft6Zf8Y+cjecbjPgxLil92HuFVPWiJZ6jHJMIwAb7YG1eILBZz9tpOFbjnQNv23EfF\n\t qLgwkfS2eK5g9sGR099rZj3d/LJPde1pCdDN/sv5W8abBQO1S8UuQPIVSQeU3ho4qY\n\t /zDi31s1PhS1UAZs0BkgrLgUm58aoRA1+xo2YclzdTOaSyWSBKwt/gg4AJrZmH752/\n\t pyO2ymWkr45puDN1IyLhQd07q2mITZZfHV24J+Dk9yfwsSvu7rwhfyl904vMw2uLSO\n\t TrJwDXlerst3A==","Received-SPF":"Pass (mailfrom) identity=mailfrom; client-ip=198.175.65.12;\n helo=mgamail.intel.com; envelope-from=larysa.zaremba@intel.com;\n receiver=","DMARC-Filter":"OpenDMARC Filter v1.4.2 smtp2.osuosl.org E033D4044A","X-CSE-ConnectionGUID":["ILy6+06JRj++BYRZtTOWfg==","8EIVIcpZRqitLPI+BaAevg=="],"X-CSE-MsgGUID":["J6QmZCOkT1CETFEPbUsYQg==","CeyFazFEQhSIaQZgcZd+ww=="],"X-IronPort-AV":["E=McAfee;i=\"6800,10657,11770\"; a=\"89833761\"","E=Sophos;i=\"6.23,205,1770624000\"; d=\"scan'208\";a=\"89833761\"","E=Sophos;i=\"6.23,205,1770624000\"; d=\"scan'208\";a=\"235968120\""],"X-ExtLoop1":"1","From":"Larysa Zaremba ","To":"intel-wired-lan@lists.osuosl.org, Jacob Keller ","Cc":"Przemek Kitszel ,\n Andrew Lunn ,\n \"David S. Miller\" ,\n Eric Dumazet , Jakub Kicinski ,\n Paolo Abeni , Joshua Hay ,\n Willem de Bruijn ,\n Alice Michael , netdev@vger.kernel.org,\n linux-kernel@vger.kernel.org,\n Aleksandr Loktionov ,\n Larysa Zaremba ,\n Tony Nguyen ","Date":"Wed, 29 Apr 2026 09:42:30 +0200","Message-ID":"<20260429074232.180528-1-larysa.zaremba@intel.com>","X-Mailer":"git-send-email 2.47.0","MIME-Version":"1.0","Content-Transfer-Encoding":"8bit","X-Mailman-Original-DKIM-Signature":"v=1; a=rsa-sha256; c=relaxed/simple;\n d=intel.com; i=@intel.com; q=dns/txt; s=Intel;\n t=1777448559; x=1808984559;\n h=from:to:cc:subject:date:message-id:mime-version:\n content-transfer-encoding;\n bh=Cr0vQaNUqcHT5qkJDPRkR29t4xZtKhdC8p1BUKcPsvY=;\n b=i/z50MRc5q2gQA6wuQLdhj5dGsVknE5cJHbKtL1pnYfD+F87QKbE83FQ\n SCo8CKimzyx5r6T6BvYMZD5uyjoWTB7sKjSPa0QKd1CoOLmK2VObPAZLG\n jASbeew4pA59oEfZH4UrgqW/f6k6n8ozHRDd1vN2HoU2uPHTO0bM+Kf8T\n Y1GWIByLlD0W2njhwJN7ndkzyIMhwSeFepUWcBdcY/wCuNagNAJlQyFzx\n A5vGgf2TuyGTbGpxVTT60t/7GTZgL7w+4ssSATGaroBSqLZfP+7sO2Ob6\n huVwSBef9P6+zilPmykd7GQQr7zPF1Iskjd3dZsts0UQn3HbUtrzc4EN5\n Q==;","X-Mailman-Original-Authentication-Results":["smtp2.osuosl.org;\n dmarc=pass (p=none dis=none)\n header.from=intel.com","smtp2.osuosl.org;\n dkim=pass (2048-bit key,\n unprotected) header.d=intel.com header.i=@intel.com header.a=rsa-sha256\n header.s=Intel header.b=i/z50MRc"],"Subject":"[Intel-wired-lan] [PATCH iwl-net] idpf: fix RSS LUT memcpy size","X-BeenThere":"intel-wired-lan@osuosl.org","X-Mailman-Version":"2.1.30","Precedence":"list","List-Id":"Intel Wired Ethernet Linux Kernel Driver Development\n ","List-Unsubscribe":",\n ","List-Archive":"","List-Post":"","List-Help":"","List-Subscribe":",\n ","Errors-To":"intel-wired-lan-bounces@osuosl.org","Sender":"\"Intel-wired-lan\" "},"content":"Based on the following feedback from Sashiko (received for iXD phase 1\npatchset, but valid for the net tree):\n\n \"Is the bounds check xn_params.recv_mem.iov_len < lut_buf_size sufficient?\n Since lut_buf_size only represents the size of the array elements, should\n this check instead verify that the payload is at least\n sizeof(struct virtchnl2_rss_lut) + lut_buf_size?\n\n [...]\n\n Does memcpy copy the correct amount of data here? rss_lut_size stores the\n number of 32-bit entries, not the size in bytes. Should it use\n lut_buf_size or rss_data->rss_lut_size * sizeof(u32) instead?\"\n\nAfter inspecting the code, it was concluded that RSS memcpy size is in fact\n4 times smaller than it has to be, since a single array entry in a u32, and\nrss_data->rss_lut_size is clearly used as an array size. Required Rx buffer\nsize is also too small, but this is a common issue in the idpf code.\n\nUse a full buffer size (lut_buf_size) instead of the array length\n(rss_data->rss_lut_size) when doing memcpy of RSS lookup table.\nWhile at it, increase required Rx buffer size to a whole flex-array\ncontaining structure instead of just the array.\n\nLink: https://sashiko.dev/#/patchset/20260323174052.5355-1-larysa.zaremba%40intel.com?part=8\nFixes: 95af467d9a4e (\"idpf: configure resources for RX queues\")\nReviewed-by: Aleksandr Loktionov \nSigned-off-by: Larysa Zaremba \n---\n drivers/net/ethernet/intel/idpf/idpf_virtchnl.c | 4 ++--\n 1 file changed, 2 insertions(+), 2 deletions(-)","diff":"diff --git a/drivers/net/ethernet/intel/idpf/idpf_virtchnl.c b/drivers/net/ethernet/intel/idpf/idpf_virtchnl.c\nindex be66f9b2e101..a97d2e9b54d4 100644\n--- a/drivers/net/ethernet/intel/idpf/idpf_virtchnl.c\n+++ b/drivers/net/ethernet/intel/idpf/idpf_virtchnl.c\n@@ -2916,7 +2916,7 @@ int idpf_send_get_set_rss_lut_msg(struct idpf_adapter *adapter,\n \t\treturn -EIO;\n \n \tlut_buf_size = le16_to_cpu(recv_rl->lut_entries) * sizeof(u32);\n-\tif (reply_sz < lut_buf_size)\n+\tif (reply_sz < lut_buf_size + sizeof(struct virtchnl2_rss_lut))\n \t\treturn -EIO;\n \n \t/* size didn't change, we can reuse existing lut buf */\n@@ -2933,7 +2933,7 @@ int idpf_send_get_set_rss_lut_msg(struct idpf_adapter *adapter,\n \t}\n \n do_memcpy:\n-\tmemcpy(rss_data->rss_lut, recv_rl->lut, rss_data->rss_lut_size);\n+\tmemcpy(rss_data->rss_lut, recv_rl->lut, lut_buf_size);\n \n \treturn 0;\n }\n","prefixes":["iwl-net"]}