linux-kernel - Re: [Bug #11382] e1000e: 2.6.27-rc1 corrupts EEPROM/NVM

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <alpine.LNX.1.10.0809250110070.4671@pegasus.suse.cz>
Date:	Thu, 25 Sep 2008 01:15:53 +0200 (CEST)
From:	Jiri Kosina <jkosina@...e.cz>
To:	David Miller <davem@...emloft.net>
cc:	jeffrey.t.kirsher@...el.com, airlied@...il.com,
	david.vrabel@....com, rjw@...k.pl, linux-kernel@...r.kernel.org,
	kernel-testers@...r.kernel.org, chrisl@...are.com,
	Ingo Molnar <mingo@...e.hu>, jbarnes@...tuousgeek.org
Subject: Re: [Bug #11382] e1000e: 2.6.27-rc1 corrupts EEPROM/NVM

On Tue, 23 Sep 2008, David Miller wrote:

> I did some snooping around, and while doing so I noticed that the PCI 
> mmap code for x86 doesn't do one bit of range checking on the size, or 
> any other aspect of the request, wrt. the MMIO regions actually mapped 
> in the BARs of the PCI device.

Ugh, indeed. Added Ingo and Jesse to CC.

> Yikes!
> 
> It just does a reserve_memtype() on the address range, and says "ok".
> 
> So if, for example, the X server tries to mmap() more than an MMIO bar
> actually maps, the kernel lets the user do this.
> 
> It would be very interesting to add the appropriate checks to
> pci_mmap_page_range() in arch/x86/pci/i386.c, anyone who wants to do
> this can use the code in arch/sparc64/kernel/pci.c:
> __pci_mmap_make_offset() as a guide, and see what happens.

Absolutely. Or we can even do some dirty hackery in userspace, like 
LD_PRELOADing X server and checking mmaps() that are close to MMIO regions 
of affected devices.

> If the MMIO space regions of the video cards sit right before the
> E1000E ones on the effected systems, that would pretty much
> convince me that this is the kind of problem we are having here.

Unfortunately, looking at the lspci outputs that are in 
https://bugzilla.novell.com/show_bug.cgi?id=425480 it seems to me that the 
MMIO regions are quite far away from each other.

-- 
Jiri Kosina
SUSE Labs
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/