[PATCH net-next 0/3][pull request] 1GbE Intel Wired LAN Driver Updates 2021-07-23

This series contains updates to igb and e100 drivers.

Grzegorz adds a timeout check to prevent possible infinite loop for igb.

Kees Cook adjusts memcpy() argument to represent the entire structure
to allow for appropriate bounds checking for igb and e100.

The following are changes since commit 356ae88f8322066a2cd1aee831b7fb768ff2905c:
  Merge branch 'bridge-tx-fwd'
and are available in the git repository at:
  git://git.kernel.org/pub/scm/linux/kernel/git/tnguy/next-queue 1GbE

Grzegorz Siwik (1):
  igb: Add counter to i21x doublecheck

Kees Cook (2):
  igb: Avoid memcpy() over-reading of ETH_SS_STATS
  e100: Avoid memcpy() over-reading of ETH_SS_STATS

 drivers/net/ethernet/intel/e100.c            | 4 ++--
 drivers/net/ethernet/intel/igb/e1000_mac.c   | 6 +++++-
 drivers/net/ethernet/intel/igb/igb_ethtool.c | 3 +--
 3 files changed, 8 insertions(+), 5 deletions(-)

-- 
2.26.2

From: Grzegorz Siwik <redacted>

Add failed_counter to i21x_doublecheck(). There is possibility that
loop will never end.
With this patch the loop will stop after maximum 3 retries
to write to MTA_REGISTER

Signed-off-by: Grzegorz Siwik <redacted>
Tested-by: Tony Brelinski <redacted>
Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
---
 drivers/net/ethernet/intel/igb/e1000_mac.c | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/drivers/net/ethernet/intel/igb/e1000_mac.c b/drivers/net/ethernet/intel/igb/e1000_mac.c
index e63ee3cca5ea..1277c5c7d099 100644
--- a/drivers/net/ethernet/intel/igb/e1000_mac.c
+++ b/drivers/net/ethernet/intel/igb/e1000_mac.c

@@ -492,6 +492,7 @@ static u32 igb_hash_mc_addr(struct e1000_hw *hw, u8 *mc_addr)
  **/
 static void igb_i21x_hw_doublecheck(struct e1000_hw *hw)
 {
+	int failed_cnt = 3;
 	bool is_failed;
 	int i;
 

@@ -502,9 +503,12 @@ static void igb_i21x_hw_doublecheck(struct e1000_hw *hw)
 				is_failed = true;
 				array_wr32(E1000_MTA, i, hw->mac.mta_shadow[i]);
 				wrfl();
-				break;
 			}
 		}
+		if (is_failed && --failed_cnt <= 0) {
+			hw_dbg("Failed to update MTA_REGISTER, too many retries");
+			break;
+		}
 	} while (is_failed);
 }
 

-- 
2.26.2

From: Kees Cook <redacted>

In preparation for FORTIFY_SOURCE performing compile-time and run-time
field bounds checking for memcpy(), memmove(), and memset(), avoid
intentionally reading across neighboring array fields.

The memcpy() is copying the entire structure, not just the first array.
Adjust the source argument so the compiler can do appropriate bounds
checking.

Signed-off-by: Kees Cook <redacted>
Tested-by: Tony Brelinski <redacted>
Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
---
 drivers/net/ethernet/intel/igb/igb_ethtool.c | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/drivers/net/ethernet/intel/igb/igb_ethtool.c b/drivers/net/ethernet/intel/igb/igb_ethtool.c
index 636a1b1fb7e1..17f5c003c3df 100644
--- a/drivers/net/ethernet/intel/igb/igb_ethtool.c
+++ b/drivers/net/ethernet/intel/igb/igb_ethtool.c

@@ -2343,8 +2343,7 @@ static void igb_get_strings(struct net_device *netdev, u32 stringset, u8 *data)
 
 	switch (stringset) {
 	case ETH_SS_TEST:
-		memcpy(data, *igb_gstrings_test,
-			IGB_TEST_LEN*ETH_GSTRING_LEN);
+		memcpy(data, igb_gstrings_test, sizeof(igb_gstrings_test));
 		break;
 	case ETH_SS_STATS:
 		for (i = 0; i < IGB_GLOBAL_STATS_LEN; i++)

-- 
2.26.2

From: Kees Cook <redacted>

In preparation for FORTIFY_SOURCE performing compile-time and run-time
field bounds checking for memcpy(), memmove(), and memset(), avoid
intentionally reading across neighboring array fields.

The memcpy() is copying the entire structure, not just the first array.
Adjust the source argument so the compiler can do appropriate bounds
checking.

Signed-off-by: Kees Cook <redacted>
Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
---
 drivers/net/ethernet/intel/e100.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/net/ethernet/intel/e100.c b/drivers/net/ethernet/intel/e100.c
index 1b0958bd24f6..1ec924c556c5 100644
--- a/drivers/net/ethernet/intel/e100.c
+++ b/drivers/net/ethernet/intel/e100.c

@@ -2715,10 +2715,10 @@ static void e100_get_strings(struct net_device *netdev, u32 stringset, u8 *data)
 {
 	switch (stringset) {
 	case ETH_SS_TEST:
-		memcpy(data, *e100_gstrings_test, sizeof(e100_gstrings_test));
+		memcpy(data, e100_gstrings_test, sizeof(e100_gstrings_test));
 		break;
 	case ETH_SS_STATS:
-		memcpy(data, *e100_gstrings_stats, sizeof(e100_gstrings_stats));
+		memcpy(data, e100_gstrings_stats, sizeof(e100_gstrings_stats));
 		break;
 	}
 }

-- 
2.26.2

Hello:

This series was applied to netdev/net-next.git (refs/heads/master):

On Fri, 23 Jul 2021 10:09:07 -0700 you wrote:

This series contains updates to igb and e100 drivers.

Grzegorz adds a timeout check to prevent possible infinite loop for igb.

Kees Cook adjusts memcpy() argument to represent the entire structure
to allow for appropriate bounds checking for igb and e100.

[...]

Here is the summary with links:
  - [net-next,1/3] igb: Add counter to i21x doublecheck
    https://git.kernel.org/netdev/net-next/c/07be39e32d0a
  - [net-next,2/3] igb: Avoid memcpy() over-reading of ETH_SS_STATS
    https://git.kernel.org/netdev/net-next/c/c9183f45e4ac
  - [net-next,3/3] e100: Avoid memcpy() over-reading of ETH_SS_STATS
    https://git.kernel.org/netdev/net-next/c/cd74f25b28ce

You are awesome, thank you!
--
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html