ice: Add a per-VF limit on number of FDIR filters

While the iavf driver adds a s/w limit (128) on the number of FDIR
filters that the VF can request, a malicious VF driver can request more
than that and exhaust the resources for other VFs.

Add a similar limit in ice.

CC: stable@vger.kernel.org
Fixes: 1f7ea1cd6a37 ("ice: Enable FDIR Configure for AVF")
Reviewed-by: Przemek Kitszel <przemyslaw.kitszel@intel.com>
Suggested-by: Sridhar Samudrala <sridhar.samudrala@intel.com>
Signed-off-by: Ahmed Zaki <ahmed.zaki@intel.com>
Reviewed-by: Wojciech Drewek <wojciech.drewek@intel.com>
Tested-by: Rafal Romanowski <rafal.romanowski@intel.com>
Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>

diff --git a/drivers/net/ethernet/intel/ice/ice_ethtool_fdir.c b/drivers/net/ethernet/intel/ice/ice_ethtool_fdir.c
index e3cab8e98f5253cc825402d3204646e19460056e..5412eff8ef233f65d59b936f9254ede4b6c349fb 100644 (file)
--- a/drivers/net/ethernet/intel/ice/ice_ethtool_fdir.c
+++ b/drivers/net/ethernet/intel/ice/ice_ethtool_fdir.c
@@ -534,7 +534,7 @@ ice_parse_rx_flow_user_data(struct ethtool_rx_flow_spec *fsp,
  *
  * Returns the number of available flow director filters to this VSI
  */
-static int ice_fdir_num_avail_fltr(struct ice_hw *hw, struct ice_vsi *vsi)
+int ice_fdir_num_avail_fltr(struct ice_hw *hw, struct ice_vsi *vsi)
 {
        u16 vsi_num = ice_get_hw_vsi_num(hw, vsi->idx);
        u16 num_guar;

diff --git a/drivers/net/ethernet/intel/ice/ice_fdir.h b/drivers/net/ethernet/intel/ice/ice_fdir.h
index 021ecbac7848f2852fdece22f514c5c09251ed90..ab5b118daa2da676b335743fa8bbebfea2071bcd 100644 (file)
--- a/drivers/net/ethernet/intel/ice/ice_fdir.h
+++ b/drivers/net/ethernet/intel/ice/ice_fdir.h
@@ -207,6 +207,8 @@ struct ice_fdir_base_pkt {
        const u8 *tun_pkt;
 };
 
+struct ice_vsi;
+
 int ice_alloc_fd_res_cntr(struct ice_hw *hw, u16 *cntr_id);
 int ice_free_fd_res_cntr(struct ice_hw *hw, u16 cntr_id);
 int ice_alloc_fd_guar_item(struct ice_hw *hw, u16 *cntr_id, u16 num_fltr);
@@ -218,6 +220,7 @@ int
 ice_fdir_get_gen_prgm_pkt(struct ice_hw *hw, struct ice_fdir_fltr *input,
                          u8 *pkt, bool frag, bool tun);
 int ice_get_fdir_cnt_all(struct ice_hw *hw);
+int ice_fdir_num_avail_fltr(struct ice_hw *hw, struct ice_vsi *vsi);
 bool ice_fdir_is_dup_fltr(struct ice_hw *hw, struct ice_fdir_fltr *input);
 bool ice_fdir_has_frag(enum ice_fltr_ptype flow);
 struct ice_fdir_fltr *

diff --git a/drivers/net/ethernet/intel/ice/ice_virtchnl_fdir.c b/drivers/net/ethernet/intel/ice/ice_virtchnl_fdir.c
index 8e4ff3af86c68b3cb495ba2bff3934ca9203c7ee..b4feb09276870fac06ecaf0cd80129b6c4b996ce 100644 (file)
--- a/drivers/net/ethernet/intel/ice/ice_virtchnl_fdir.c
+++ b/drivers/net/ethernet/intel/ice/ice_virtchnl_fdir.c
@@ -536,6 +536,8 @@ static void ice_vc_fdir_reset_cnt_all(struct ice_vf_fdir *fdir)
                fdir->fdir_fltr_cnt[flow][0] = 0;
                fdir->fdir_fltr_cnt[flow][1] = 0;
        }
+
+       fdir->fdir_fltr_cnt_total = 0;
 }
 
 /**
@@ -1560,6 +1562,7 @@ ice_vc_add_fdir_fltr_post(struct ice_vf *vf, struct ice_vf_fdir_ctx *ctx,
        resp->status = status;
        resp->flow_id = conf->flow_id;
        vf->fdir.fdir_fltr_cnt[conf->input.flow_type][is_tun]++;
+       vf->fdir.fdir_fltr_cnt_total++;
 
        ret = ice_vc_send_msg_to_vf(vf, ctx->v_opcode, v_ret,
                                    (u8 *)resp, len);
@@ -1624,6 +1627,7 @@ ice_vc_del_fdir_fltr_post(struct ice_vf *vf, struct ice_vf_fdir_ctx *ctx,
        resp->status = status;
        ice_vc_fdir_remove_entry(vf, conf, conf->flow_id);
        vf->fdir.fdir_fltr_cnt[conf->input.flow_type][is_tun]--;
+       vf->fdir.fdir_fltr_cnt_total--;
 
        ret = ice_vc_send_msg_to_vf(vf, ctx->v_opcode, v_ret,
                                    (u8 *)resp, len);
@@ -1790,6 +1794,7 @@ int ice_vc_add_fdir_fltr(struct ice_vf *vf, u8 *msg)
        struct virtchnl_fdir_add *stat = NULL;
        struct virtchnl_fdir_fltr_conf *conf;
        enum virtchnl_status_code v_ret;
+       struct ice_vsi *vf_vsi;
        struct device *dev;
        struct ice_pf *pf;
        int is_tun = 0;
@@ -1798,6 +1803,17 @@ int ice_vc_add_fdir_fltr(struct ice_vf *vf, u8 *msg)
 
        pf = vf->pf;
        dev = ice_pf_to_dev(pf);
+       vf_vsi = ice_get_vf_vsi(vf);
+
+#define ICE_VF_MAX_FDIR_FILTERS        128
+       if (!ice_fdir_num_avail_fltr(&pf->hw, vf_vsi) ||
+           vf->fdir.fdir_fltr_cnt_total >= ICE_VF_MAX_FDIR_FILTERS) {
+               v_ret = VIRTCHNL_STATUS_ERR_PARAM;
+               dev_err(dev, "Max number of FDIR filters for VF %d is reached\n",
+                       vf->vf_id);
+               goto err_exit;
+       }
+
        ret = ice_vc_fdir_param_check(vf, fltr->vsi_id);
        if (ret) {
                v_ret = VIRTCHNL_STATUS_ERR_PARAM;

diff --git a/drivers/net/ethernet/intel/ice/ice_virtchnl_fdir.h b/drivers/net/ethernet/intel/ice/ice_virtchnl_fdir.h
index c5bcc8d7481ca655ba4a5fb14fd418a4c54724d7..ac6dcab454b499b19def71d2fe7932d89405fa7e 100644 (file)
--- a/drivers/net/ethernet/intel/ice/ice_virtchnl_fdir.h
+++ b/drivers/net/ethernet/intel/ice/ice_virtchnl_fdir.h
@@ -29,6 +29,7 @@ struct ice_vf_fdir_ctx {
 struct ice_vf_fdir {
        u16 fdir_fltr_cnt[ICE_FLTR_PTYPE_MAX][ICE_FD_HW_SEG_MAX];
        int prof_entry_cnt[ICE_FLTR_PTYPE_MAX][ICE_FD_HW_SEG_MAX];
+       u16 fdir_fltr_cnt_total;
        struct ice_fd_hw_prof **fdir_prof;
 
        struct idr fdir_rule_idr;