linux-kernel - RE: [RFC PATCH net-next 9/9] ethtool: Add ability to flash transceiver modules' firmware

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Tue, 23 Jan 2024 13:05:16 +0000
From: Danielle Ratson <danieller@...dia.com>
To: Jakub Kicinski <kuba@...nel.org>
CC: "netdev@...r.kernel.org" <netdev@...r.kernel.org>, "davem@...emloft.net"
	<davem@...emloft.net>, "edumazet@...gle.com" <edumazet@...gle.com>,
	"pabeni@...hat.com" <pabeni@...hat.com>, "corbet@....net" <corbet@....net>,
	"linux@...linux.org.uk" <linux@...linux.org.uk>, "sdf@...gle.com"
	<sdf@...gle.com>, "kory.maincent@...tlin.com" <kory.maincent@...tlin.com>,
	"maxime.chevallier@...tlin.com" <maxime.chevallier@...tlin.com>,
	"vladimir.oltean@....com" <vladimir.oltean@....com>,
	"przemyslaw.kitszel@...el.com" <przemyslaw.kitszel@...el.com>,
	"ahmed.zaki@...el.com" <ahmed.zaki@...el.com>, "richardcochran@...il.com"
	<richardcochran@...il.com>, "shayagr@...zon.com" <shayagr@...zon.com>,
	"paul.greenwalt@...el.com" <paul.greenwalt@...el.com>, "jiri@...nulli.us"
	<jiri@...nulli.us>, "linux-doc@...r.kernel.org" <linux-doc@...r.kernel.org>,
	"linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>, mlxsw
	<mlxsw@...dia.com>, Petr Machata <petrm@...dia.com>, Ido Schimmel
	<idosch@...dia.com>
Subject: RE: [RFC PATCH net-next 9/9] ethtool: Add ability to flash
 transceiver modules' firmware

> >  #include <linux/ethtool.h>
> > +#include <linux/sfp.h>
> > +#include <linux/firmware.h>
> 
> alphabetical order, please

Ok.

> 
> > +static int
> > +module_flash_fw_schedule(struct net_device *dev,
> > +			 struct ethtool_module_fw_flash_params *params,
> > +			 struct netlink_ext_ack *extack)
> > +{
> > +	const struct ethtool_ops *ops = dev->ethtool_ops;
> > +	struct ethtool_module_fw_flash *module_fw;
> > +	int err;
> > +
> > +	if (!ops->set_module_eeprom_by_page ||
> > +	    !ops->get_module_eeprom_by_page) {
> > +		NL_SET_ERR_MSG(extack,
> > +			       "Flashing module firmware is not supported by
> this device");
> > +		return -EOPNOTSUPP;
> > +	}
> > +
> > +	if (dev->module_fw_flash_in_progress) {
> > +		NL_SET_ERR_MSG(extack, "Module firmware flashing already
> in progress");
> > +		return -EBUSY;
> > +	}
> > +
> > +	module_fw = kzalloc(sizeof(*module_fw), GFP_KERNEL);
> > +	if (!module_fw)
> > +		return -ENOMEM;
> > +
> > +	module_fw->params = *params;
> > +	err = request_firmware(&module_fw->fw, module_fw-
> >params.file_name,
> 
> request_firmware_direct() ? I think udev timeout is 30 sec and we're holding
> rtnl_lock.. I don't remember why we didn't use that in devlink

Ok will change.

> 
> > +			       &dev->dev);
> > +	if (err) {
> > +		NL_SET_ERR_MSG(extack,
> > +			       "Failed to request module firmware image");
> > +		goto err_request_firmware;
> > +	}
> > +
> > +	err = module_flash_fw_work_init(module_fw, dev, extack);
> > +	if (err < 0) {
> > +		NL_SET_ERR_MSG(extack,
> > +			       "Flashing module firmware is not supported by
> this device");
> > +		goto err_work_init;
> > +	}
> > +
> > +	dev->module_fw_flash_in_progress = true;
> 
> What does this protect us from?

Currently, it protects us from flashing an in-progress-flashing-module.

> 
> > +static int module_flash_fw(struct net_device *dev, struct nlattr **tb,
> > +			   struct netlink_ext_ack *extack) {
> > +	struct ethtool_module_fw_flash_params params = {};
> > +	struct nlattr *attr;
> > +
> > +	if (!tb[ETHTOOL_A_MODULE_FW_FLASH_FILE_NAME]) {
> > +		NL_SET_ERR_MSG_ATTR(extack,
> 
> GENL_REQ_ATTR_CHECK, and you can check it in the caller, before taking
> rtnl_lock.
> 

OK, np. The idea was to have module_flash_fw() that checks the attrs and extract them into params and ethnl_act_module_fw_flash() should be free from those checks.
But if so, maybe this separation is redundant and should combine the two?

> > +
> tb[ETHTOOL_A_MODULE_FW_FLASH_FILE_NAME],
> > +				    "File name attribute is missing");
> > +		return -EINVAL;
> > +	}
> > +
> > +	params.file_name =
> > +		nla_data(tb[ETHTOOL_A_MODULE_FW_FLASH_FILE_NAME]);
> 
> Hm. I think you copy the param struct by value to the work container.
> nla_data() is in the skb which is going to get freed after _ACT returns.
> So if anyone tries to access the name from the work it's going to UAF?

The file_name parameter is not really needed inside the work. Once we called request_firmware_direct(), we have all that we need in module_fw->fw.
Do we still need to avoid that situation? If so, can you please suggest how?

> 
> > +
> > +	attr = tb[ETHTOOL_A_MODULE_FW_FLASH_PASSWORD];
> > +	if (attr) {
> > +		params.password = cpu_to_be32(nla_get_u32(attr));
> > +		params.password_valid = true;
> > +	}
> > +
> > +	return module_flash_fw_schedule(dev, &params, extack); }
>