net: fbnic: validate mailbox TLV extents

Browse source

The mailbox path warns when a message claims more bytes than the descriptor
but still parses it. The attribute walkers also validate a child TLV before
proving that its declared span fits in the parent remainder.

Reject invalid mailbox message extents and bound each child attribute
before type-specific validation.

Cc: stable+noautosel@kernel.org # assumes malicious PCIe device
Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn>
Link: https://patch.msgid.link/20260830142516.38145-1-pengpeng@iscas.ac.cn
Signed-off-by: Jakub Kicinski <kuba@kernel.org>

...

This commit is contained in:

Pengpeng Hou 2026-08-30 22:24:58 +08:00 • committed by Jakub Kicinski

parent 0a1071aa32

commit c29b37ed7a

2 changed files with 16 additions and 6 deletions

Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL

Download patch file Download diff file Expand all files Collapse all files

9

drivers/net/ethernet/meta/fbnic/fbnic_fw.c

View file

13

drivers/net/ethernet/meta/fbnic/fbnic_tlv.c

View file