linux-kernel - RE: [BUG] RDMA/hw/qib/qib_iba6120: possible buffer underflow in rcvctrl_6120

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <CH0PR01MB71533F43952BA6C56AC21C4EF2FE9@CH0PR01MB7153.prod.exchangelabs.com>
Date:   Tue, 17 Aug 2021 18:37:25 +0000
From:   "Marciniszyn, Mike" <mike.marciniszyn@...nelisnetworks.com>
To:     Tuo Li <islituo@...il.com>,
        "Dalessandro, Dennis" <dennis.dalessandro@...nelisnetworks.com>,
        "dledford@...hat.com" <dledford@...hat.com>,
        "jgg@...pe.ca" <jgg@...pe.ca>
CC:     "linux-rdma@...r.kernel.org" <linux-rdma@...r.kernel.org>,
        Linux Kernel <linux-kernel@...r.kernel.org>,
        "baijiaju1990@...il.com" <baijiaju1990@...il.com>
Subject: RE: [BUG] RDMA/hw/qib/qib_iba6120: possible buffer underflow in
 rcvctrl_6120_mod()

> Subject: [BUG] RDMA/hw/qib/qib_iba6120: possible buffer underflow in
> rcvctrl_6120_mod()
> 
> Hello,
> 
> Our static analysis tool reports a possible buffer underflow in qib_iba6120.c in
> Linux 5.14.0-rc3:
> 
> The variable ctxt is checked in:
> 2110:    if (ctxt < 0)
> 
> This indicates that ctxt can be negative.
> If so, possible buffer underflows will occur:
> 2120:    qib_write_kreg_ctxt(dd, kr_rcvhdrtailaddr, ctxt,
> dd->rcd[ctxt]->rcvhdrqtailaddr_phys);
> 2122:    qib_write_kreg_ctxt(dd, kr_rcvhdraddr, ctxt,
> dd->rcd[ctxt]->rcvhdrq_phys);
> 
> However, I am not sure whether ctxt < 0 and op & QIB_RCVCTRL_CTXT_ENB
> can be true at the same time.
> 
> Any feedback would be appreciated, thanks!
> 

Look at the assignment to f_rcvctrl and the calls using that variable:
5 qib_iba6120.c  qib_init_iba6120_funcs 3463 dd->f_rcvctrl = rcvctrl_6120_mod;
6 qib_iba7220.c  qib_init_iba7220_funcs 4508 dd->f_rcvctrl = rcvctrl_7220_mod;
7 qib_iba7322.c  qib_init_iba7322_funcs 7198 dd->f_rcvctrl = rcvctrl_7322_mod;

All these functions have the same "issue".   The -1 parameter implies all contexts and the -1 ctxt happens from init_after_reset() and qib_shutdown_device() and by code inspection,  they only or in operations that lack QIB_RCVCTRL_CTXT_ENB, thus avoiding the code path that writes a per context CSR using the ctxt as an index.

I don't think this is an issue.

Mike