linux-hardening - Re: [PATCH net 2/2] iavf: Fix out-of-bounds when setting channels on remove

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Wed, 19 Apr 2023 08:53:21 +0800
From:   Ding Hui <dinghui@...gfor.com.cn>
To:     Michal Kubiak <michal.kubiak@...el.com>
Cc:     davem@...emloft.net, edumazet@...gle.com, kuba@...nel.org,
        pabeni@...hat.com, intel-wired-lan@...ts.osuosl.org,
        jesse.brandeburg@...el.com, anthony.l.nguyen@...el.com,
        keescook@...omium.org, grzegorzx.szczurek@...el.com,
        mateusz.palczewski@...el.com, netdev@...r.kernel.org,
        linux-kernel@...r.kernel.org, linux-hardening@...r.kernel.org,
        Donglin Peng <pengdonglin@...gfor.com.cn>,
        Huang Cun <huangcun@...gfor.com.cn>
Subject: Re: [PATCH net 2/2] iavf: Fix out-of-bounds when setting channels on
 remove

On 2023/4/19 0:11, Michal Kubiak wrote:
> On Sat, Apr 08, 2023 at 10:00:30PM +0800, Ding Hui wrote:
>> If we set channels greater when iavf_remove, the waiting reset done
>> will be timeout, then returned with error but changed num_active_queues
>> directly, that will lead to OOB like the following logs. Because the
>> num_active_queues is greater than tx/rx_rings[] allocated actually.
>>

...

>>
>> diff --git a/drivers/net/ethernet/intel/iavf/iavf_ethtool.c b/drivers/net/ethernet/intel/iavf/iavf_ethtool.c
>> index 6f171d1d85b7..d8a3c0cfedd0 100644
>> --- a/drivers/net/ethernet/intel/iavf/iavf_ethtool.c
>> +++ b/drivers/net/ethernet/intel/iavf/iavf_ethtool.c
>> @@ -1857,13 +1857,15 @@ static int iavf_set_channels(struct net_device *netdev,
>>   	/* wait for the reset is done */
>>   	for (i = 0; i < IAVF_RESET_WAIT_COMPLETE_COUNT; i++) {
>>   		msleep(IAVF_RESET_WAIT_MS);
>> +		if (test_bit(__IAVF_IN_REMOVE_TASK, &adapter->crit_section))
>> +			return -EOPNOTSUPP;
>>   		if (adapter->flags & IAVF_FLAG_RESET_PENDING)
>>   			continue;
>>   		break;
>>   	}
>>   	if (i == IAVF_RESET_WAIT_COMPLETE_COUNT) {
>>   		adapter->flags &= ~IAVF_FLAG_REINIT_ITR_NEEDED;
>> -		adapter->num_active_queues = num_req;
>> +		adapter->num_req_queues = 0;
>>   		return -EOPNOTSUPP;
>>   	}
>>   
> 
> Looks OK to me.
> Just consider moving repro scripts from the cover letter to the commit
> message.
> 

Sure, I will. Thanks again.

-- 
Thanks,
- Ding Hui