i40e: add validation for ring_len param

JIRA: https://issues.redhat.com/browse/RHEL-123809
CVE: CVE-2025-39973

commit 55d2256
Author: Lukasz Czapnik <lukasz.czapnik@intel.com>
Date:   Wed Aug 13 12:45:11 2025 +0200

    i40e: add validation for ring_len param

    The `ring_len` parameter provided by the virtual function (VF)
    is assigned directly to the hardware memory context (HMC) without
    any validation.

    To address this, introduce an upper boundary check for both Tx and Rx
    queue lengths. The maximum number of descriptors supported by the
    hardware is 8k-32.
    Additionally, enforce alignment constraints: Tx rings must be a multiple
    of 8, and Rx rings must be a multiple of 32.

    Fixes: 5c3c48a ("i40e: implement virtual device interface")
    Cc: stable@vger.kernel.org
    Signed-off-by: Lukasz Czapnik <lukasz.czapnik@intel.com>
    Reviewed-by: Aleksandr Loktionov <aleksandr.loktionov@intel.com>
    Signed-off-by: Przemek Kitszel <przemyslaw.kitszel@intel.com>
    Reviewed-by: Simon Horman <horms@kernel.org>
    Tested-by: Rafal Romanowski <rafal.romanowski@intel.com>
    Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>

Signed-off-by: Michal Schmidt <mschmidt@redhat.com>

Author: michich

drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c

@@ -653,6 +653,13 @@ static int i40e_config_vsi_tx_queue(struct i40e_vf *vf, u16 vsi_id,
 
 	/* only set the required fields */
 	tx_ctx.base = info->dma_ring_addr / 128;
+
+	/* ring_len has to be multiple of 8 */
+	if (!IS_ALIGNED(info->ring_len, 8) ||
+	    info->ring_len > I40E_MAX_NUM_DESCRIPTORS_XL710) {
+		ret = -EINVAL;
+		goto error_context;
+	}
 	tx_ctx.qlen = info->ring_len;
 	tx_ctx.rdylist = le16_to_cpu(vsi->info.qs_handle[0]);
 	tx_ctx.rdylist_act = 0;
@@ -716,6 +723,13 @@ static int i40e_config_vsi_rx_queue(struct i40e_vf *vf, u16 vsi_id,
 
 	/* only set the required fields */
 	rx_ctx.base = info->dma_ring_addr / 128;
+
+	/* ring_len has to be multiple of 32 */
+	if (!IS_ALIGNED(info->ring_len, 32) ||
+	    info->ring_len > I40E_MAX_NUM_DESCRIPTORS_XL710) {
+		ret = -EINVAL;
+		goto error_param;
+	}
 	rx_ctx.qlen = info->ring_len;
 
 	if (info->splithdr_enabled) {