netdev - Re: [PATCH net-next v3 6/8] net: phy: mscc: timestamping and PHC support

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Sat, 20 Jun 2020 08:00:45 -0700
From:   Richard Cochran <richardcochran@...il.com>
To:     Antoine Tenart <antoine.tenart@...tlin.com>
Cc:     davem@...emloft.net, andrew@...n.ch, f.fainelli@...il.com,
        hkallweit1@...il.com, alexandre.belloni@...tlin.com,
        UNGLinuxDriver@...rochip.com, netdev@...r.kernel.org,
        linux-kernel@...r.kernel.org, thomas.petazzoni@...tlin.com,
        allan.nielsen@...rochip.com, foss@...il.net
Subject: Re: [PATCH net-next v3 6/8] net: phy: mscc: timestamping and PHC
 support

On Fri, Jun 19, 2020 at 02:22:58PM +0200, Antoine Tenart wrote:

> +static void vsc85xx_dequeue_skb(struct vsc85xx_ptp *ptp)
> +{
> +	struct skb_shared_hwtstamps shhwtstamps;
> +	struct vsc85xx_ts_fifo fifo;
> +	struct sk_buff *skb;
> +	u8 skb_sig[16], *p;
> +	int i, len;
> +	u32 reg;
> +
> +	memset(&fifo, 0, sizeof(fifo));
> +	p = (u8 *)&fifo;
> +
> +	reg = vsc85xx_ts_read_csr(ptp->phydev, PROCESSOR,
> +				  MSCC_PHY_PTP_EGR_TS_FIFO(0));
> +	if (reg & PTP_EGR_TS_FIFO_EMPTY)
> +		return;
> +
> +	*p++ = reg & 0xff;
> +	*p++ = (reg >> 8) & 0xff;
> +
> +	/* Read the current FIFO item. Reading FIFO6 pops the next one. */
> +	for (i = 1; i < 7; i++) {
> +		reg = vsc85xx_ts_read_csr(ptp->phydev, PROCESSOR,
> +					  MSCC_PHY_PTP_EGR_TS_FIFO(i));
> +		*p++ = reg & 0xff;
> +		*p++ = (reg >> 8) & 0xff;
> +		*p++ = (reg >> 16) & 0xff;
> +		*p++ = (reg >> 24) & 0xff;
> +	}
> +
> +	len = skb_queue_len(&ptp->tx_queue);
> +	if (len < 1)
> +		return;
> +
> +	while (len--) {
> +		skb = __skb_dequeue(&ptp->tx_queue);
> +		if (!skb)
> +			return;
> +
> +		/* Can't get the signature of the packet, won't ever
> +		 * be able to have one so let's dequeue the packet.
> +		 */
> +		if (get_sig(skb, skb_sig) < 0)
> +			continue;

This leaks the skb.

> +		/* Check if we found the signature we were looking for. */
> +		if (!memcmp(skb_sig, fifo.sig, sizeof(fifo.sig))) {
> +			memset(&shhwtstamps, 0, sizeof(shhwtstamps));
> +			shhwtstamps.hwtstamp = ktime_set(fifo.secs, fifo.ns);
> +			skb_complete_tx_timestamp(skb, &shhwtstamps);
> +
> +			return;
> +		}
> +
> +		/* Valid signature but does not match the one of the
> +		 * packet in the FIFO right now, reschedule it for later
> +		 * packets.
> +		 */
> +		__skb_queue_tail(&ptp->tx_queue, skb);
> +	}
> +}

Thanks,
Richard