netdev - Re: [PATCH net 2/9] bnx2x: Prevent an illegal pointer dereference during panic

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-Id: <20131017.142134.1058688642083607743.davem@davemloft.net>
Date:	Thu, 17 Oct 2013 14:21:34 -0400 (EDT)
From:	David Miller <davem@...emloft.net>
To:	yuvalmin@...adcom.com
Cc:	netdev@...r.kernel.org, ariele@...adcom.com, eilong@...adcom.com,
	dmitry@...adcom.com
Subject: Re: [PATCH net 2/9] bnx2x: Prevent an illegal pointer dereference
 during panic

From: "Yuval Mintz" <yuvalmin@...adcom.com>
Date: Tue, 15 Oct 2013 16:28:48 +0200

> @@ -775,6 +775,15 @@ void bnx2x_fw_dump_lvl(struct bnx2x *bp, const char *lvl)
>  		trace_shmem_base = bp->common.shmem_base;
>  	else
>  		trace_shmem_base = SHMEM2_RD(bp, other_shmem_base_addr);
> +
> +	/* sanity */
> +	if (trace_shmem_base < MCPR_SCRATCH_BASE(bp) ||
> +	    trace_shmem_base > MCPR_SCRATCH_BASE(bp) + 0x28000) {

I would say that this second test should be ">=" rather than ">".

Actually, there are a lot of holes still remaining here.

trace_shmem_base is validated, but then you access the signature at
0x800 bytes before trace_shmem_base value.  That should be accounted
for in the test above too.

And what about that 'mark' value you read?  Any validations needed on
that?

And then you read from "addr" to "mark", and I see no checks that this
range makes any sense either.
--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html