linux-kernel - Re: [PATCH net 1/2] net/ethernet/chelsio: fix cxgb4

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <Y8ZonuQJn8gO9GX5@unreal>
Date:   Tue, 17 Jan 2023 11:21:34 +0200
From:   Leon Romanovsky <leon@...nel.org>
To:     Maksim Davydov <davydov-max@...dex-team.ru>
Cc:     rajur@...lsio.com, davem@...emloft.net, edumazet@...gle.com,
        kuba@...nel.org, pabeni@...hat.com, anish@...lsio.com,
        hariprasad@...lsio.com, netdev@...r.kernel.org,
        linux-kernel@...r.kernel.org
Subject: Re: [PATCH net 1/2] net/ethernet/chelsio: fix cxgb4_getpgtccfg wrong
 memory access

On Mon, Jan 16, 2023 at 06:20:59PM +0300, Maksim Davydov wrote:
> *pgid can be in range 0 to 0xF (bitmask 0xF) but valid values for PGID
> are between 0 and 7. Also the size of pgrate is 8. Thus, we are needed
> additional check to make sure that this code doesn't have access to tsa.
> 
> Found by Linux Verification Center (linuxtesting.org) with the SVACE
> static analysis tool.
> 
> Fixes: 76bcb31efc06 ("cxgb4 : Add DCBx support codebase and dcbnl_ops")
> Signed-off-by: Maksim Davydov <davydov-max@...dex-team.ru>
> ---
>  drivers/net/ethernet/chelsio/cxgb4/cxgb4_dcb.c | 5 ++++-
>  1 file changed, 4 insertions(+), 1 deletion(-)
> 
> diff --git a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_dcb.c b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_dcb.c
> index 7d5204834ee2..3aa65f0f335e 100644
> --- a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_dcb.c
> +++ b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_dcb.c
> @@ -471,7 +471,10 @@ static void cxgb4_getpgtccfg(struct net_device *dev, int tc,
>  		return;
>  	}
>  
> -	*bw_per = pcmd.u.dcb.pgrate.pgrate[*pgid];
> +	/* Valid values are: 0-7 */

How do you see it?

There are lines below that assume something different.
   477         /* prio_type is link strict */
   478         if (*pgid != 0xF)
   479                 *prio_type = 0x2;


> +	if (*pgid <= 7)
> +		*bw_per = pcmd.u.dcb.pgrate.pgrate[*pgid];

Why do you think that it is valid simply do not set *bw_per?

Thanks