linux-kernel - [PATCH net] qed: Don't write past the end of GRC debug buffer

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-Id: <2bac01100416be1edd9b44a963f872a4c25fda03.1755231426.git.jamie.bainbridge@gmail.com>
Date: Fri, 15 Aug 2025 14:17:25 +1000
From: Jamie Bainbridge <jamie.bainbridge@...il.com>
To: Manish Chopra <manishc@...vell.com>,
	Andrew Lunn <andrew+netdev@...n.ch>,
	"David S. Miller" <davem@...emloft.net>,
	Eric Dumazet <edumazet@...gle.com>,
	Jakub Kicinski <kuba@...nel.org>,
	Paolo Abeni <pabeni@...hat.com>,
	Ariel Elior <Ariel.Elior@...ium.com>,
	Michal Kalderon <Michal.Kalderon@...ium.com>,
	Manish Rangankar <manish.rangankar@...ium.com>
Cc: Jamie Bainbridge <jamie.bainbridge@...il.com>,
	netdev@...r.kernel.org,
	linux-kernel@...r.kernel.org
Subject: [PATCH net] qed: Don't write past the end of GRC debug buffer

In the GRC dump path, "len" count of dword-sized registers are read into
the previously-allocated GRC dump buffer.

However, the amount of data written into the GRC dump buffer is never
checked against the length of the dump buffer. This can result in
writing past the end of the dump buffer's kmalloc and a kernel panic.

Resolve this by clamping the amount of data written to the length of the
dump buffer, avoiding the out-of-bounds memory access and panic.

Fixes: d52c89f120de8 ("qed*: Utilize FW 8.37.2.0")
Signed-off-by: Jamie Bainbridge <jamie.bainbridge@...il.com>
---
 drivers/net/ethernet/qlogic/qed/qed_debug.c | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/drivers/net/ethernet/qlogic/qed/qed_debug.c b/drivers/net/ethernet/qlogic/qed/qed_debug.c
index 9c3d3dd2f84753100d3c639505677bd53e3ca543..2e88fd79a02e220fc05caa8c27bb7d41b4b37c0d 100644
--- a/drivers/net/ethernet/qlogic/qed/qed_debug.c
+++ b/drivers/net/ethernet/qlogic/qed/qed_debug.c
@@ -2085,6 +2085,13 @@ static u32 qed_grc_dump_addr_range(struct qed_hwfn *p_hwfn,
 		dev_data->pretend.split_id = split_id;
 	}
 
+	/* Ensure we don't write past the end of the GRC buffer */
+	u32 buf_size_bytes = p_hwfn->cdev->dbg_features[DBG_FEATURE_GRC].buf_size;
+	u32 len_bytes = len * sizeof(u32);
+
+	if (len_bytes > buf_size_bytes)
+		len = buf_size_bytes / sizeof(u32);
+
 	/* Read registers using GRC */
 	qed_read_regs(p_hwfn, p_ptt, dump_buf, addr, len);
 
-- 
2.39.5