{"id":2232468,"url":"http://patchwork.ozlabs.org/api/1.1/patches/2232468/?format=json","web_url":"http://patchwork.ozlabs.org/project/intel-wired-lan/patch/20260504144345.293219-1-larysa.zaremba@intel.com/","project":{"id":46,"url":"http://patchwork.ozlabs.org/api/1.1/projects/46/?format=json","name":"Intel Wired Ethernet development","link_name":"intel-wired-lan","list_id":"intel-wired-lan.osuosl.org","list_email":"intel-wired-lan@osuosl.org","web_url":"","scm_url":"","webscm_url":""},"msgid":"<20260504144345.293219-1-larysa.zaremba@intel.com>","date":"2026-05-04T14:43:43","name":"[iwl-net,v2] idpf: fix RSS LUT memcpy size","commit_ref":null,"pull_url":null,"state":"changes-requested","archived":false,"hash":"a494950166c0b5d345265acc04c8ce74fc773af8","submitter":{"id":84900,"url":"http://patchwork.ozlabs.org/api/1.1/people/84900/?format=json","name":"Larysa Zaremba","email":"larysa.zaremba@intel.com"},"delegate":null,"mbox":"http://patchwork.ozlabs.org/project/intel-wired-lan/patch/20260504144345.293219-1-larysa.zaremba@intel.com/mbox/","series":[{"id":502674,"url":"http://patchwork.ozlabs.org/api/1.1/series/502674/?format=json","web_url":"http://patchwork.ozlabs.org/project/intel-wired-lan/list/?series=502674","date":"2026-05-04T14:43:43","name":"[iwl-net,v2] idpf: fix RSS LUT memcpy size","version":2,"mbox":"http://patchwork.ozlabs.org/series/502674/mbox/"}],"comments":"http://patchwork.ozlabs.org/api/patches/2232468/comments/","check":"pending","checks":"http://patchwork.ozlabs.org/api/patches/2232468/checks/","tags":{},"headers":{"Return-Path":"","X-Original-To":["incoming@patchwork.ozlabs.org","intel-wired-lan@lists.osuosl.org"],"Delivered-To":["patchwork-incoming@legolas.ozlabs.org","intel-wired-lan@lists.osuosl.org"],"Authentication-Results":["legolas.ozlabs.org;\n\tdkim=pass (2048-bit key;\n unprotected) header.d=osuosl.org header.i=@osuosl.org header.a=rsa-sha256\n header.s=default header.b=7YrQZZQJ;\n\tdkim-atps=neutral","legolas.ozlabs.org;\n spf=pass (sender SPF authorized) smtp.mailfrom=osuosl.org\n (client-ip=2605:bc80:3010::138; helo=smtp1.osuosl.org;\n envelope-from=intel-wired-lan-bounces@osuosl.org;\n receiver=patchwork.ozlabs.org)"],"Received":["from smtp1.osuosl.org (smtp1.osuosl.org [IPv6:2605:bc80:3010::138])\n\t(using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)\n\t key-exchange x25519 server-signature ECDSA (secp384r1) server-digest SHA384)\n\t(No client certificate requested)\n\tby legolas.ozlabs.org (Postfix) with ESMTPS id 4g8PY5038Yz1yJV\n\tfor ; Tue, 05 May 2026 00:44:08 +1000 (AEST)","from localhost (localhost [127.0.0.1])\n\tby smtp1.osuosl.org (Postfix) with ESMTP id 2E041845A0;\n\tMon, 4 May 2026 14:44:07 +0000 (UTC)","from smtp1.osuosl.org ([127.0.0.1])\n by localhost (smtp1.osuosl.org [127.0.0.1]) (amavis, port 10024) with ESMTP\n id Ex8nSmJVI0n0; Mon, 4 May 2026 14:44:06 +0000 (UTC)","from lists1.osuosl.org (lists1.osuosl.org [140.211.166.142])\n\tby smtp1.osuosl.org (Postfix) with ESMTP id 4E1AA845A9;\n\tMon, 4 May 2026 14:44:06 +0000 (UTC)","from smtp4.osuosl.org (smtp4.osuosl.org [140.211.166.137])\n by lists1.osuosl.org (Postfix) with ESMTP id 31246190\n for ; Mon, 4 May 2026 14:44:05 +0000 (UTC)","from localhost (localhost [127.0.0.1])\n by smtp4.osuosl.org (Postfix) with ESMTP id 16F9641B27\n for ; Mon, 4 May 2026 14:44:05 +0000 (UTC)","from smtp4.osuosl.org ([127.0.0.1])\n by localhost (smtp4.osuosl.org [127.0.0.1]) (amavis, port 10024) with ESMTP\n id YPT9QGCdCWbL for ;\n Mon, 4 May 2026 14:44:04 +0000 (UTC)","from mgamail.intel.com (mgamail.intel.com [192.198.163.7])\n by smtp4.osuosl.org (Postfix) with ESMTPS id F192741B23\n for ; Mon, 4 May 2026 14:44:03 +0000 (UTC)","from orviesa004.jf.intel.com ([10.64.159.144])\n by fmvoesa101.fm.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384;\n 04 May 2026 07:44:02 -0700","from irvmail002.ir.intel.com ([10.43.11.120])\n by orviesa004.jf.intel.com with ESMTP; 04 May 2026 07:44:00 -0700","from mglak.igk.intel.com (mglak.igk.intel.com [10.237.112.146])\n by irvmail002.ir.intel.com (Postfix) with ESMTP id C17812FC54;\n Mon, 4 May 2026 15:43:57 +0100 (IST)"],"X-Virus-Scanned":["amavis at osuosl.org","amavis at osuosl.org"],"X-Comment":"SPF check N/A for local connections - client-ip=140.211.166.142;\n helo=lists1.osuosl.org; envelope-from=intel-wired-lan-bounces@osuosl.org;\n receiver= ","DKIM-Filter":["OpenDKIM Filter v2.11.0 smtp1.osuosl.org 4E1AA845A9","OpenDKIM Filter v2.11.0 smtp4.osuosl.org F192741B23"],"DKIM-Signature":"v=1; a=rsa-sha256; c=relaxed/relaxed; d=osuosl.org;\n\ts=default; t=1777905846;\n\tbh=9OJPchOLKnKjF1Giyck+amz4Xh8JCjtrswZ2QTe92YI=;\n\th=From:To:Cc:Date:Subject:List-Id:List-Unsubscribe:List-Archive:\n\t List-Post:List-Help:List-Subscribe:From;\n\tb=7YrQZZQJrmEuorAP7vOtFtCe/5pnIRjGvMeBuSohJI+HkVxHh8o72esHREYQeh4Qn\n\t jyumFNHchNa1xDzyI3vM+4u3t6z2+/Pu0udZ6H5MlED98RNApYojefzwRghysiJZe2\n\t A9gFsd0bvp4mjvUEcaAItODOqzisQ0wkqbHsNMV8dtTXieljygRyVx+AMqorxFtsKq\n\t tRr7iSMgK9CzG2pSFB6XQORqOsvgfgqiuW6StbrmRnyT5ehxT/kJ09grMFIetBExmH\n\t uN1C4UiApzKM7WJXIi6qJsvYdyMJFlejE+ubZuVkMHnQq3tWl3seqh5+Xk7wH1kx6g\n\t 6fAZjburee+qg==","Received-SPF":"Pass (mailfrom) identity=mailfrom; client-ip=192.198.163.7;\n helo=mgamail.intel.com; envelope-from=larysa.zaremba@intel.com;\n receiver=","DMARC-Filter":"OpenDMARC Filter v1.4.2 smtp4.osuosl.org F192741B23","X-CSE-ConnectionGUID":["oVPIxFEfQKan/3ndybgv0A==","oj3o4ySlTKuiwaDDHYKuVQ=="],"X-CSE-MsgGUID":["Gz6N+bltQCavJ46/DjrhpA==","dV99omDhT2OF7cZLzXNe6Q=="],"X-IronPort-AV":["E=McAfee;i=\"6800,10657,11776\"; a=\"104211935\"","E=Sophos;i=\"6.23,215,1770624000\"; d=\"scan'208\";a=\"104211935\"","E=Sophos;i=\"6.23,215,1770624000\"; d=\"scan'208\";a=\"239830499\""],"X-ExtLoop1":"1","From":"Larysa Zaremba ","To":"intel-wired-lan@lists.osuosl.org, Jacob Keller ","Cc":"Larysa Zaremba ,\n Przemek Kitszel ,\n Andrew Lunn ,\n \"David S. Miller\" ,\n Eric Dumazet , Jakub Kicinski ,\n Paolo Abeni , Joshua Hay ,\n Willem de Bruijn , netdev@vger.kernel.org,\n linux-kernel@vger.kernel.org,\n Aleksandr Loktionov ,\n Tony Nguyen , Simon Horman ","Date":"Mon, 4 May 2026 16:43:43 +0200","Message-ID":"<20260504144345.293219-1-larysa.zaremba@intel.com>","X-Mailer":"git-send-email 2.47.0","MIME-Version":"1.0","Content-Transfer-Encoding":"8bit","X-Mailman-Original-DKIM-Signature":"v=1; a=rsa-sha256; c=relaxed/simple;\n d=intel.com; i=@intel.com; q=dns/txt; s=Intel;\n t=1777905844; x=1809441844;\n h=from:to:cc:subject:date:message-id:mime-version:\n content-transfer-encoding;\n bh=YvBSeEFqbbJHPGpcBG9RqC3NXahLfq7pQptie9Q7N2Q=;\n b=KbmM7AeBbgzmeVHxZbzSezscjUckmWOu1pY0cKJa0xRnExAICVtkRsip\n w1ddPm8vCDMdeZ0dl/uZh6I4ckYHayMM52ns7K/pASNzt5guZCPENv1hN\n qRLiCKw0kmRBYDciT2wg7KNQJXGIxPv4X1PTJm/2ajGzjiwwHegCDaC3n\n GCupWXDVQVCB4Jz86UTd8p3WSzfuZf44VPaQ1W0mK3DvViHl1hoZlRMI1\n 4Lq7bp4tcBso6rBDsbTfqwUkQ+zzBy7aHoTeUOxajRUMJJ9PMyJk7pU1g\n HSgh7y2w1w43aWdnnCSoQ9VdUPMRjKFB1G40pPgysgEEm2I5SDwK9RSHV\n A==;","X-Mailman-Original-Authentication-Results":["smtp4.osuosl.org;\n dmarc=pass (p=none dis=none)\n header.from=intel.com","smtp4.osuosl.org;\n dkim=pass (2048-bit key,\n unprotected) header.d=intel.com header.i=@intel.com header.a=rsa-sha256\n header.s=Intel header.b=KbmM7AeB"],"Subject":"[Intel-wired-lan] [PATCH iwl-net v2] idpf: fix RSS LUT memcpy size","X-BeenThere":"intel-wired-lan@osuosl.org","X-Mailman-Version":"2.1.30","Precedence":"list","List-Id":"Intel Wired Ethernet Linux Kernel Driver Development\n ","List-Unsubscribe":",\n ","List-Archive":"","List-Post":"","List-Help":"","List-Subscribe":",\n ","Errors-To":"intel-wired-lan-bounces@osuosl.org","Sender":"\"Intel-wired-lan\" "},"content":"Based on the following feedback from Sashiko (received for iXD phase 1\npatchset, but valid for the net tree):\n\n \"Is the bounds check xn_params.recv_mem.iov_len < lut_buf_size sufficient?\n Since lut_buf_size only represents the size of the array elements, should\n this check instead verify that the payload is at least\n sizeof(struct virtchnl2_rss_lut) + lut_buf_size?\n\n [...]\n\n Does memcpy copy the correct amount of data here? rss_lut_size stores the\n number of 32-bit entries, not the size in bytes. Should it use\n lut_buf_size or rss_data->rss_lut_size * sizeof(u32) instead?\"\n\nAfter inspecting the code, it was concluded that RSS memcpy size is in fact\n4 times smaller than it has to be, since a single array entry in a u32, and\nrss_data->rss_lut_size is clearly used as an array size. Required Rx buffer\nsize is also too small, but this is a common issue in the idpf code.\n\nUse a full buffer size (lut_buf_size) instead of the array length\n(rss_data->rss_lut_size) when doing memcpy of RSS lookup table.\nWhile at it, increase required Rx buffer size to a whole flex-array\ncontaining structure instead of just the array.\n\nLink: https://sashiko.dev/#/patchset/20260323174052.5355-1-larysa.zaremba%40intel.com?part=8\nFixes: 95af467d9a4e (\"idpf: configure resources for RX queues\")\nReviewed-by: Aleksandr Loktionov \nReviewed-by: Simon Horman \nSigned-off-by: Larysa Zaremba \n---\nv1 -> v2: replace manual array size calculation with flex_array_size()\n\nv1: https://lore.kernel.org/netdev/20260429074232.180528-1-larysa.zaremba@intel.com/\n\n drivers/net/ethernet/intel/idpf/idpf_virtchnl.c | 7 ++++---\n 1 file changed, 4 insertions(+), 3 deletions(-)","diff":"diff --git a/drivers/net/ethernet/intel/idpf/idpf_virtchnl.c b/drivers/net/ethernet/intel/idpf/idpf_virtchnl.c\nindex be66f9b2e101..0fc7c68447f8 100644\n--- a/drivers/net/ethernet/intel/idpf/idpf_virtchnl.c\n+++ b/drivers/net/ethernet/intel/idpf/idpf_virtchnl.c\n@@ -2915,8 +2915,9 @@ int idpf_send_get_set_rss_lut_msg(struct idpf_adapter *adapter,\n \tif (reply_sz < sizeof(struct virtchnl2_rss_lut))\n \t\treturn -EIO;\n \n-\tlut_buf_size = le16_to_cpu(recv_rl->lut_entries) * sizeof(u32);\n-\tif (reply_sz < lut_buf_size)\n+\tlut_buf_size = flex_array_size(recv_rl, lut,\n+\t\t\t\t le16_to_cpu(recv_rl->lut_entries));\n+\tif (reply_sz < lut_buf_size + sizeof(struct virtchnl2_rss_lut))\n \t\treturn -EIO;\n \n \t/* size didn't change, we can reuse existing lut buf */\n@@ -2933,7 +2934,7 @@ int idpf_send_get_set_rss_lut_msg(struct idpf_adapter *adapter,\n \t}\n \n do_memcpy:\n-\tmemcpy(rss_data->rss_lut, recv_rl->lut, rss_data->rss_lut_size);\n+\tmemcpy(rss_data->rss_lut, recv_rl->lut, lut_buf_size);\n \n \treturn 0;\n }\n","prefixes":["iwl-net","v2"]}