| From 6ab90ea4a4c377f3ea00282ded5d551866fc7d06 Mon Sep 17 00:00:00 2001 |
| From: Sasha Levin <sashal@kernel.org> |
| Date: Sun, 18 Jul 2021 15:36:30 -0400 |
| Subject: bnxt_en: Validate vlan protocol ID on RX packets |
| |
| From: Michael Chan <michael.chan@broadcom.com> |
| |
| [ Upstream commit 96bdd4b9ea7ef9a12db8fdd0ce90e37dffbd3703 ] |
| |
| Only pass supported VLAN protocol IDs for stripped VLAN tags to the |
| stack. The stack will hit WARN() if the protocol ID is unsupported. |
| |
| Existing firmware sets up the chip to strip 0x8100, 0x88a8, 0x9100. |
| Only the 1st two protocols are supported by the kernel. |
| |
| Fixes: a196e96bb68f ("bnxt_en: clean up VLAN feature bit handling") |
| Reviewed-by: Somnath Kotur <somnath.kotur@broadcom.com> |
| Signed-off-by: Michael Chan <michael.chan@broadcom.com> |
| Signed-off-by: David S. Miller <davem@davemloft.net> |
| Signed-off-by: Sasha Levin <sashal@kernel.org> |
| --- |
| drivers/net/ethernet/broadcom/bnxt/bnxt.c | 21 ++++++++++++++++----- |
| 1 file changed, 16 insertions(+), 5 deletions(-) |
| |
| diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt.c b/drivers/net/ethernet/broadcom/bnxt/bnxt.c |
| index 49aca3289c00..be36dee65f90 100644 |
| --- a/drivers/net/ethernet/broadcom/bnxt/bnxt.c |
| +++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.c |
| @@ -1640,11 +1640,16 @@ static inline struct sk_buff *bnxt_tpa_end(struct bnxt *bp, |
| |
| if ((tpa_info->flags2 & RX_CMP_FLAGS2_META_FORMAT_VLAN) && |
| (skb->dev->features & BNXT_HW_FEATURE_VLAN_ALL_RX)) { |
| - u16 vlan_proto = tpa_info->metadata >> |
| - RX_CMP_FLAGS2_METADATA_TPID_SFT; |
| + __be16 vlan_proto = htons(tpa_info->metadata >> |
| + RX_CMP_FLAGS2_METADATA_TPID_SFT); |
| u16 vtag = tpa_info->metadata & RX_CMP_FLAGS2_METADATA_TCI_MASK; |
| |
| - __vlan_hwaccel_put_tag(skb, htons(vlan_proto), vtag); |
| + if (eth_type_vlan(vlan_proto)) { |
| + __vlan_hwaccel_put_tag(skb, vlan_proto, vtag); |
| + } else { |
| + dev_kfree_skb(skb); |
| + return NULL; |
| + } |
| } |
| |
| skb_checksum_none_assert(skb); |
| @@ -1865,9 +1870,15 @@ static int bnxt_rx_pkt(struct bnxt *bp, struct bnxt_cp_ring_info *cpr, |
| (skb->dev->features & BNXT_HW_FEATURE_VLAN_ALL_RX)) { |
| u32 meta_data = le32_to_cpu(rxcmp1->rx_cmp_meta_data); |
| u16 vtag = meta_data & RX_CMP_FLAGS2_METADATA_TCI_MASK; |
| - u16 vlan_proto = meta_data >> RX_CMP_FLAGS2_METADATA_TPID_SFT; |
| + __be16 vlan_proto = htons(meta_data >> |
| + RX_CMP_FLAGS2_METADATA_TPID_SFT); |
| |
| - __vlan_hwaccel_put_tag(skb, htons(vlan_proto), vtag); |
| + if (eth_type_vlan(vlan_proto)) { |
| + __vlan_hwaccel_put_tag(skb, vlan_proto, vtag); |
| + } else { |
| + dev_kfree_skb(skb); |
| + goto next_rx; |
| + } |
| } |
| |
| skb_checksum_none_assert(skb); |
| -- |
| 2.30.2 |
| |