netdev - Re: [PATCH] r8169: fix invalid register dump

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Thu, 15 Aug 2013 22:33:15 +0200
From:	Ben Hutchings <bhutchings@...arflare.com>
To:	Peter Wu <lekensteyn@...il.com>
CC:	Francois Romieu <romieu@...zoreil.com>, <netdev@...r.kernel.org>,
	<nic_swsd@...ltek.com>
Subject: Re: [PATCH] r8169: fix invalid register dump

On Wed, 2013-08-14 at 23:31 +0200, Peter Wu wrote:
> On Wednesday 14 August 2013 21:58:29 Francois Romieu wrote:
> > > -     memcpy_fromio(p, tp->mmio_addr, regs->len);
> > > +     if (regs->len >= 4) {
> > > +             for (i = 0; i < regs->len - 4; i += 4)
> > > +                     memcpy_fromio(bytes + i, tp->mmio_addr + i, 4);
> > > +     }
> > > +     if (i < regs->len)
> > 
> > Comparison with random stack stuff when regs->len < 4. :o/
> 
> Right, let's rm $OLD_PATCH and consider this one.
> 
> Checklist:
> 1. super large regs->len: won't be greater than R8169_REGS_SIZE (256)
> 2. regs->len == 0: 0 < 0 is false, nothing is copied
> 3. regs->len is 1, 2 or 3: i = 0, at most 3 bytes will be copied
> 4. regs->len is 4, i < 4 - 4, skip loop, 0 < regs->len, copy 4
> 5. regs->len is 5, i < 5 - 4, copy; 4 < regs->len, copy 1
[...]

The kernel buffer size is max(regs->len,
dev->ethtool_ops->get_regs_len()).  So you can safely ignore regs->len
and always read all your registers.

Ben.

-- 
Ben Hutchings, Staff Engineer, Solarflare
Not speaking for my employer; that's the marketing department's job.
They asked us to note that Solarflare product names are trademarked.

--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html