i40e: fix validation of VF state in get resources

JIRA: https://issues.redhat.com/browse/RHEL-123809
CVE: CVE-2025-39969

commit 877b7e6
Author: Lukasz Czapnik <lukasz.czapnik@intel.com>
Date:   Wed Aug 13 12:45:15 2025 +0200

    i40e: fix validation of VF state in get resources

    VF state I40E_VF_STATE_ACTIVE is not the only state in which
    VF is actually active so it should not be used to determine
    if a VF is allowed to obtain resources.

    Use I40E_VF_STATE_RESOURCES_LOADED that is set only in
    i40e_vc_get_vf_resources_msg() and cleared during reset.

    Fixes: 61125b8 ("i40e: Fix failed opcode appearing if handling messages from VF")
    Cc: stable@vger.kernel.org
    Signed-off-by: Lukasz Czapnik <lukasz.czapnik@intel.com>
    Reviewed-by: Aleksandr Loktionov <aleksandr.loktionov@intel.com>
    Signed-off-by: Przemek Kitszel <przemyslaw.kitszel@intel.com>
    Reviewed-by: Simon Horman <horms@kernel.org>
    Tested-by: Rafal Romanowski <rafal.romanowski@intel.com>
    Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>

Signed-off-by: Michal Schmidt <mschmidt@redhat.com>

Author: michich

drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c

@@ -1467,6 +1467,7 @@ static void i40e_trigger_vf_reset(struct i40e_vf *vf, bool flr)
 	 * functions that may still be running at this point.
 	 */
 	clear_bit(I40E_VF_STATE_INIT, &vf->vf_states);
+	clear_bit(I40E_VF_STATE_RESOURCES_LOADED, &vf->vf_states);
 
 	/* In the case of a VFLR, the HW has already reset the VF and we
 	 * just need to clean up, so don't hit the VFRTRIG register.
@@ -2133,7 +2134,10 @@ static int i40e_vc_get_vf_resources_msg(struct i40e_vf *vf, u8 *msg)
 	size_t len = 0;
 	int ret;
 
-	if (!i40e_sync_vf_state(vf, I40E_VF_STATE_INIT)) {
+	i40e_sync_vf_state(vf, I40E_VF_STATE_INIT);
+
+	if (!test_bit(I40E_VF_STATE_INIT, &vf->vf_states) ||
+	    test_bit(I40E_VF_STATE_RESOURCES_LOADED, &vf->vf_states)) {
 		aq_ret = -EINVAL;
 		goto err;
 	}
@@ -2236,6 +2240,7 @@ static int i40e_vc_get_vf_resources_msg(struct i40e_vf *vf, u8 *msg)
 				vf->default_lan_addr.addr);
 	}
 	set_bit(I40E_VF_STATE_ACTIVE, &vf->vf_states);
+	set_bit(I40E_VF_STATE_RESOURCES_LOADED, &vf->vf_states);
 
 err:
 	/* send the response back to the VF */

drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.h

@@ -41,7 +41,8 @@ enum i40e_vf_states {
 	I40E_VF_STATE_MC_PROMISC,
 	I40E_VF_STATE_UC_PROMISC,
 	I40E_VF_STATE_PRE_ENABLE,
-	I40E_VF_STATE_RESETTING
+	I40E_VF_STATE_RESETTING,
+	I40E_VF_STATE_RESOURCES_LOADED,
 };
 
 /* VF capabilities */