linux-kernel - qlogic: netxen: possibly incorrect mask used for a couple of NEXTXEN_DIMM

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <90373113-c45f-4fdb-bbe9-08cb65b862d3@gmail.com>
Date: Thu, 8 May 2025 12:52:19 +0100
From: "Colin King (gmail)" <colin.i.king@...il.com>
To: Manish Chopra <manishc@...vell.com>, Manish Chopra <manishc@...vell.com>,
 GR-Linux-NIC-Dev@...vell.com, Andrew Lunn <andrew+netdev@...n.ch>,
 "David S. Miller" <davem@...emloft.net>, Eric Dumazet <edumazet@...gle.com>,
 Jakub Kicinski <kuba@...nel.org>, Paolo Abeni <pabeni@...hat.com>,
 "netdev@...r.kernel.org" <netdev@...r.kernel.org>
Cc: "linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>
Subject: qlogic: netxen: possibly incorrect mask used for a couple of
 NEXTXEN_DIMM_* macros

Hi,

In drivers/net/ethernet/qlogic/netxen/netxen_nic_hdr.h there are the 
following macros:

#define NETXEN_DIMM_NUMRANKS(VAL)               ((VAL >> 15) & 0x3)
#define NETXEN_DIMM_DATAWIDTH(VAL)              ((VAL >> 18) & 0x3)
#define NETXEN_DIMM_NUMBANKS(VAL)               ((VAL >> 21) & 0xf)

The NETXEN_DIMM_NUMRANKS and NETXEN_DIMM_DATAWIDTH macros extract 3 bits 
worth of information from VAL however the mask is 0x3 (just 2 bits) 
rather than 0x7 (3 bits). I don't have the hardware or datasheet for the 
hardware so I can't be sure if this is intentional or just a masking bug 
in one and/or both of these two macros.

I highly suspect the NETXEN_DIMM_DATAWIDTH is incorrect because 8 
different data widths are being checked in the switch statement in 
netxen_sysfs_read_dimm():

        switch (dw) {
         case 0x0:
                 dw = 32;
                 break;
         case 0x1:
                 dw = 33;
                 break;
         case 0x2:
                 dw = 36;
                 break;
         case 0x3:
                 dw = 64;
                 break;
         case 0x4:
                 dw = 72;
                 break;
         case 0x5:
                 dw = 80;
                 break;
         case 0x6:
                 dw = 128;
                 break;
         case 0x7:
                 dw = 144;
                 break;
         default:
                 netdev_err(netdev, "Invalid data-width %x\n", dw);
                 goto out;
         }

Anyhow, I'm unsure about this and I wanted to flag this up as potential 
issue in the driver.

Colin

Download attachment "OpenPGP_0x68C287DFC6A80226.asc" of type "application/pgp-keys" (4825 bytes)

Download attachment "OpenPGP_signature.asc" of type "application/pgp-signature" (841 bytes)