ixgbevf: fix spoofed packets with random MAC

If ixgbevf is loaded while the corresponding PF interface is down
and the driver assigns a random MAC address, that address can be
overwritten with the value of hw->mac.perm_addr, which would be 0 at
that point.

To avoid this case we init hw->mac.perm_addr to the randomly generated
address and do not set it unless we receive ACK from ixgbe.

Reported-by: John Greene <jogreene@redhat.com>
Signed-off-by: Emil Tantilov <emil.s.tantilov@intel.com>
Tested-by: Krishneil Singh <Krishneil.k.singh@intel.com>
Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>

diff --git a/drivers/net/ethernet/intel/ixgbevf/ixgbevf_main.c b/drivers/net/ethernet/intel/ixgbevf/ixgbevf_main.c
index 47c71e1fe1ce6d5b04891fc00e63a7e079d5e22a..dbbd1be474626f400f178413fa480272ddc40747 100644 (file)
--- a/drivers/net/ethernet/intel/ixgbevf/ixgbevf_main.c
+++ b/drivers/net/ethernet/intel/ixgbevf/ixgbevf_main.c
@@ -2664,6 +2664,7 @@ static int ixgbevf_sw_init(struct ixgbevf_adapter *adapter)
                dev_info(&pdev->dev, "Assigning random MAC address\n");
                eth_hw_addr_random(netdev);
                ether_addr_copy(hw->mac.addr, netdev->dev_addr);
+               ether_addr_copy(hw->mac.perm_addr, netdev->dev_addr);
        }
 
        /* Enable dynamic interrupt throttling rates */

diff --git a/drivers/net/ethernet/intel/ixgbevf/vf.c b/drivers/net/ethernet/intel/ixgbevf/vf.c
index 427f3605cbfc8035f03910d564eeb5e707a5c58c..61a98f4c5746fbf9d76aa1467c4388b6f3574a2e 100644 (file)
--- a/drivers/net/ethernet/intel/ixgbevf/vf.c
+++ b/drivers/net/ethernet/intel/ixgbevf/vf.c
@@ -117,7 +117,9 @@ static s32 ixgbevf_reset_hw_vf(struct ixgbe_hw *hw)
            msgbuf[0] != (IXGBE_VF_RESET | IXGBE_VT_MSGTYPE_NACK))
                return IXGBE_ERR_INVALID_MAC_ADDR;
 
-       ether_addr_copy(hw->mac.perm_addr, addr);
+       if (msgbuf[0] == (IXGBE_VF_RESET | IXGBE_VT_MSGTYPE_ACK))
+               ether_addr_copy(hw->mac.perm_addr, addr);
+
        hw->mac.mc_filter_type = msgbuf[IXGBE_VF_MC_TYPE_WORD];
 
        return 0;