Bug 207031 - ixv driver accesses offsets beyond the VF's PCI BAR
Summary: ixv driver accesses offsets beyond the VF's PCI BAR
Status: New
Alias: None
Product: Base System
Classification: Unclassified
Component: kern (show other bugs)
Version: CURRENT
Hardware: Any Any
: --- Affects Only Me
Assignee: freebsd-net (Nobody)
Keywords: IntelNetworking, patch
Depends on:
Reported: 2016-02-08 22:27 UTC by Jeremiah
Modified: 2016-02-09 01:31 UTC (History)
1 user (show)

See Also:

Proposed patch (1.32 KB, patch)
2016-02-08 22:27 UTC, Jeremiah
no flags Details | Diff

Note You need to log in before you can comment on or make changes to this bug.
Description Jeremiah 2016-02-08 22:27:06 UTC
Created attachment 166757 [details]
Proposed patch

The ixv driver incorrectly accesses the following non-VF registers: IXGBE_ERRBC and IXGBE_RXCSUM. The offset of these registers is actually larger than the VF's bar size, so it ends up overflowing and accessing the next BAR instead. This could cause issues, but by happenstance it ends up writing to an unused portion of the MSI-X table BAR of the VF, which seems to have no ill effect. Could cause problems if the pci layout were changed/different and definitely appears to be incorrect.

I attached a patch that removes these accesses. Removing the IXGBE_ERRBC access should be no problem. For IXGBE_RXCSUM I'm less sure, but I don't see any equivalent register to set in the VF register specification.