From nobody Thu Oct 29 06:40:13 2026 X-Original-To: dev-commits-src-branches@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4jFZNY6Sqlz6xtth for ; Thu, 29 Oct 2026 06:40:13 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (No client certificate requested) by mx1.freebsd.org (Postfix) with ESMTPS id 4jFZNY3PNvz3Jyb for ; Thu, 29 Oct 2026 06:40:13 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1793256013; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=DGk2wZtP6ns5l/A+5Ej9KiVcPTiZL8BEkQFxkn6tpmQ=; b=udOihFhddcQmCUZFIwSdetmSMwp40peIKeZePHab4Duff5sCw+KuQrbdDXfa9gPfJokKmF VxApIM85M8XcU74MyRfaHFFCfRvaZjbDO2khax6rD0gT44E4jcMdIIjd2xQHSAhxlGcNhk 0HVPydLvA7Q8q0ZbfHVPNXvnAMhiQKT0B9VJhsIlryvecwV9Yfr4zE+IVOfyjoDSUiP9xw 1hLpSnAp38ATyCiFzwzCpWhwTcc1wT0vw3Q1kmPnZF72qO7rC4LGDGR7t1IuVPl762EwhU AOYhMbPGawRSLa3LhGjxz8ajnD3h4vYcUkwLweWjA7PR+wWsmkl7v8UzCaUItQ== ARC-Seal: i=1; a=rsa-sha256; d=freebsd.org; s=dkim; cv=none; t=1793256013; b=hK7/CinrDKkT2YNqF43IAc7qfao5oWrCXbiHR+Y2VkEWr2L0QWl7p6Gubu0U2HngAgX/ny 8GNstdJ50odj9FKFwgtEpfLykRhZyBbFfqnrZSba2TXWVnnEvn35IsIWWb8a3b6shdSfzV agyF23YVDXjjPNGKA2OM9ZdmS7HZuRSwnWoim8Zl1HW5La0FoOvROtHESzYfGKgQsrUxhp XbWy4/+Vm0QBe8ZFSykTgtUwapQ3843mKXLigQc8O8ELiKK244cbaEqbNmr4XhL7MsNoJF v6XpmKxYdskICVGTCsQ4lFsZzL8KSNwWZ8tSYhUdHKiGISodOm+0hSDAuXkBBQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1793256013; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=DGk2wZtP6ns5l/A+5Ej9KiVcPTiZL8BEkQFxkn6tpmQ=; b=QaiEf9di/ILd6uTSs8cVCtWwb16weLTA6nLK7m+Y0DPSwr8v4yhua07Xt7Z62KljSiz4/o 6P9mmvXOHlF4G9kPxIf2wWTirnXScyW3ZhUa8dzctWyn+ywWwWfZowKRyP3Kgo+aBMwU2d Z8ShDhzsea2byMnNc4mwKRvSju8W0WB53Z0XqzhPcHW5QwZp4GOL0D1m5VXFn7rMzmdaFq lXEaHRrP7NmT+JQ4Yiq52kjG8ByZq6LPDTJkC0JJ3rM95CTYC9rihYZD5Te2vZWfY0we2C OFs8GpK5S05h+CqToqX//W9AR07oEcSYy1hlTMonOq7uHzszC+Zsh9w5w4vOGA== ARC-Authentication-Results: i=1; mx1.freebsd.org; none Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4jFZNY312DzRRK for ; Thu, 29 Oct 2026 06:40:13 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 3d552 by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Thu, 29 Oct 2026 06:40:13 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org From: Kevin Bowling Subject: git: 6bbbab0402c1 - stable/15 - ice: Add malformed virtchnl injection points List-Archive: https://lists.freebsd.org/archives/dev-commits-src-branches X-BeenThere: dev-commits-src-branches@freebsd.org Sender: owner-dev-commits-src-branches@FreeBSD.org List-Id: Commits to the stable branches of the FreeBSD src repository List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: kbowling X-Git-Repository: src X-Git-Refname: refs/heads/stable/15 X-Git-Reftype: branch X-Git-Commit: 6bbbab0402c1a1152d6898669564c3397c9ecb05 Auto-Submitted: auto-generated Date: Thu, 29 Oct 2026 06:40:13 +0000 Message-Id: <6ae2ea4d.3d552.12261017@gitrepo.freebsd.org> The branch stable/15 has been updated by kbowling: URL: https://cgit.FreeBSD.org/src/commit/?id=6bbbab0402c1a1152d6898669564c3397c9ecb05 commit 6bbbab0402c1a1152d6898669564c3397c9ecb05 Author: Kevin Bowling AuthorDate: 2026-08-19 03:18:53 +0000 Commit: Kevin Bowling CommitDate: 2026-10-29 06:39:56 +0000 ice: Add malformed virtchnl injection points Extend the optional ice(4) failure injection facility with semantic corruption points for queue configuration, RSS keys and tables, and interrupt mappings. Each point mutates an otherwise valid request after the common virtchnl length check. This exercises the PF semantic validators with a real VF while preserving the normal wire format and mailbox path. The queue point selects unaligned Tx or Rx bases, an unaligned or unrepresentable receive buffer, an invalid frame size, duplicate queue IDs, or a bad VSI. The RSS points select short advertised data or an out-of-range LUT entry. The interrupt point selects an invalid ITR, traffic on vector zero, duplicate vectors, or a bad VSI. The points remain absent unless the kernel is built with options DRIVER_FAILPOINTS and retain the existing PF and VF selectors. Sponsored by: BBOX.io Differential Revision: https://reviews.freebsd.org/D59021 (cherry picked from commit e70ff92d243104834ad40581c3562a55d7525cc8) --- sys/dev/ice/ice_iov.c | 72 +++++++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 72 insertions(+) diff --git a/sys/dev/ice/ice_iov.c b/sys/dev/ice/ice_iov.c index eab735820f8e..0c5d49ebf5b1 100644 --- a/sys/dev/ice/ice_iov.c +++ b/sys/dev/ice/ice_iov.c @@ -1421,6 +1421,41 @@ ice_vc_cfg_vsi_qs_msg(struct ice_softc *sc, struct ice_vf *vf, u8 *msg_buf) int i, error = 0; vqci = (struct virtchnl_vsi_queue_config_info *)msg_buf; + ICE_FAIL_POINT_CODE_COND(sc, _debug_fail_point_ice_iov, + malformed_queues, ice_iov_fail_vf_matches(vf->vf_num), + FAIL_POINT_NONSLEEPABLE, { + switch (RETURN_VALUE) { + case 1: + vqci->qpair[0].txq.dma_ring_addr |= 1; + break; + case 2: + vqci->qpair[0].rxq.dma_ring_addr |= 1; + break; + case 3: + vqci->qpair[0].rxq.databuffer_size++; + break; + case 4: + vqci->qpair[0].rxq.max_pkt_size = 0; + break; + case 5: + if (vqci->num_queue_pairs > 1) { + vqci->qpair[1].txq.queue_id = + vqci->qpair[0].txq.queue_id; + vqci->qpair[1].rxq.queue_id = + vqci->qpair[0].rxq.queue_id; + } else { + vqci->qpair[0].txq.queue_id++; + } + break; + case 6: + vqci->qpair[0].rxq.databuffer_size = + ICE_VC_MAX_RX_BUFFER + BIT(ICE_RLAN_CTX_DBUF_S); + break; + default: + vqci->vsi_id++; + break; + } + }); if (vqci->vsi_id != vsi->idx || vqci->num_queue_pairs == 0 || vqci->num_queue_pairs > sizeof(queue_map) * NBBY || @@ -1569,6 +1604,11 @@ ice_vc_cfg_rss_key_msg(struct ice_softc *sc, struct ice_vf *vf, u8 *msg_buf) struct ice_vsi *vsi = vf->vsi; vrk = (struct virtchnl_rss_key *)msg_buf; + ICE_FAIL_POINT_CODE_COND(sc, _debug_fail_point_ice_iov, + malformed_rss_key, ice_iov_fail_vf_matches(vf->vf_num), + FAIL_POINT_NONSLEEPABLE, { + vrk->key_len--; + }); if (vrk->vsi_id != vsi->idx) { device_printf(sc->dev, @@ -1619,6 +1659,14 @@ ice_vc_cfg_rss_lut_msg(struct ice_softc *sc, struct ice_vf *vf, u8 *msg_buf) struct ice_vsi *vsi = vf->vsi; vrl = (struct virtchnl_rss_lut *)msg_buf; + ICE_FAIL_POINT_CODE_COND(sc, _debug_fail_point_ice_iov, + malformed_rss_lut, ice_iov_fail_vf_matches(vf->vf_num), + FAIL_POINT_NONSLEEPABLE, { + if (RETURN_VALUE == 1) + vrl->lut_entries--; + else + vrl->lut[0] = vsi->num_rx_queues; + }); if (vrl->vsi_id != vsi->idx) { device_printf(sc->dev, @@ -1824,6 +1872,30 @@ ice_vc_cfg_irq_map_msg(struct ice_softc *sc, struct ice_vf *vf, u8 *msg_buf) u16 rxqs_seen, txqs_seen, valid_rxqs, valid_txqs, vector; vimi = (struct virtchnl_irq_map_info *)msg_buf; + ICE_FAIL_POINT_CODE_COND(sc, _debug_fail_point_ice_iov, + malformed_irq_map, ice_iov_fail_vf_matches(vf->vf_num), + FAIL_POINT_NONSLEEPABLE, { + switch (RETURN_VALUE) { + case 1: + vimi->vecmap[0].rxitr_idx = VIRTCHNL_ITR_IDX_NO_ITR + 1; + break; + case 2: + vimi->vecmap[0].vector_id = 0; + vimi->vecmap[0].rxq_map = 1; + break; + case 3: + if (vimi->num_vectors > 1) { + vimi->vecmap[1].vector_id = + vimi->vecmap[0].vector_id; + } else { + vimi->vecmap[0].vsi_id++; + } + break; + default: + vimi->vecmap[0].vsi_id++; + break; + } + }); if (vimi->num_vectors == 0 || vimi->num_vectors > vf->num_irq_vectors ||