linux-hardening - [PATCH][next] octeontx2-pf: Fix out-of-bounds read in otx2_get

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date:   Fri, 12 Feb 2021 14:50:01 +0000
From:   Hariprasad Kelam <hkelam@...vell.com>
To:     "Gustavo A. R. Silva" <gustavoars@...nel.org>,
        Sunil Kovvuri Goutham <sgoutham@...vell.com>,
        Geethasowjanya Akula <gakula@...vell.com>,
        "Subbaraya Sundeep Bhatta" <sbhatta@...vell.com>,
        "David S. Miller" <davem@...emloft.net>,
        Jakub Kicinski <kuba@...nel.org>,
        Jesse Brandeburg <jesse.brandeburg@...el.com>,
        Christina Jacob <cjacob@...vell.com>
CC:     "netdev@...r.kernel.org" <netdev@...r.kernel.org>,
        "linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>,
        "linux-hardening@...r.kernel.org" <linux-hardening@...r.kernel.org>
Subject: [PATCH][next] octeontx2-pf: Fix out-of-bounds read in
 otx2_get_fecparam()

Hi Gustavo ,

Please see inline,

> -----Original Message-----
> From: Gustavo A. R. Silva <gustavoars@...nel.org>
> Sent: Friday, February 12, 2021 5:53 PM
> To: Sunil Kovvuri Goutham <sgoutham@...vell.com>; Geethasowjanya
> Akula <gakula@...vell.com>; Subbaraya Sundeep Bhatta
> <sbhatta@...vell.com>; Hariprasad Kelam <hkelam@...vell.com>; David
> S. Miller <davem@...emloft.net>; Jakub Kicinski <kuba@...nel.org>; Jesse
> Brandeburg <jesse.brandeburg@...el.com>; Christina Jacob
> <cjacob@...vell.com>
> Cc: netdev@...r.kernel.org; linux-kernel@...r.kernel.org; Gustavo A. R.
> Silva <gustavoars@...nel.org>; linux-hardening@...r.kernel.org
> Subject: [EXT] [PATCH][next] octeontx2-pf: Fix out-of-bounds read in
> otx2_get_fecparam()
> 
> External Email
> 
> ----------------------------------------------------------------------
> Code at line 967 implies that rsp->fwdata.supported_fec may be up to 4:
> 
>  967: if (rsp->fwdata.supported_fec <= FEC_MAX_INDEX)
>
Thanks for pointing this. I missed this case .
rsp->fwdata.supported_fec range  is 0 to 3.  Certainly 4 causes out-of-bounds.
But proper fix is 
-  if (rsp->fwdata.supported_fec <= FEC_MAX_INDEX)
+ : if (rsp->fwdata.supported_fec < FEC_MAX_INDEX)

Thanks,
Hariprasad k





> If rsp->fwdata.supported_fec evaluates to 4, then there is an out-of-bounds
> read at line 971 because fec is an array with a maximum of 4 elements:
> 
>  954         const int fec[] = {
>  955                 ETHTOOL_FEC_OFF,
>  956                 ETHTOOL_FEC_BASER,
>  957                 ETHTOOL_FEC_RS,
>  958                 ETHTOOL_FEC_BASER | ETHTOOL_FEC_RS};
>  959 #define FEC_MAX_INDEX 4
> 
>  971: fecparam->fec = fec[rsp->fwdata.supported_fec];
> 
> Fix this by properly indexing fec[] with rsp->fwdata.supported_fec - 1.
> In this case the proper indexes 0 to 3 are used when
> rsp->fwdata.supported_fec evaluates to a range of 1 to 4, correspondingly.
> 
> Fixes: d0cf9503e908 ("octeontx2-pf: ethtool fec mode support")
> Addresses-Coverity-ID: 1501722 ("Out-of-bounds read")
> Signed-off-by: Gustavo A. R. Silva <gustavoars@...nel.org>
> ---
>  drivers/net/ethernet/marvell/octeontx2/nic/otx2_ethtool.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/drivers/net/ethernet/marvell/octeontx2/nic/otx2_ethtool.c
> b/drivers/net/ethernet/marvell/octeontx2/nic/otx2_ethtool.c
> index 237e5d3321d4..f7e8ada32a26 100644
> --- a/drivers/net/ethernet/marvell/octeontx2/nic/otx2_ethtool.c
> +++ b/drivers/net/ethernet/marvell/octeontx2/nic/otx2_ethtool.c
> @@ -968,7 +968,7 @@ static int otx2_get_fecparam(struct net_device
> *netdev,
>  		if (!rsp->fwdata.supported_fec)
>  			fecparam->fec = ETHTOOL_FEC_NONE;
>  		else
> -			fecparam->fec = fec[rsp->fwdata.supported_fec];
> +			fecparam->fec = fec[rsp->fwdata.supported_fec - 1];
>  	}
>  	return 0;
>  }
> --
> 2.27.0