netdev - Re: [net-next 9/9] i40e: silence an UBSAN false positive

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20200622173510.04ee7bf3@kicinski-fedora-pc1c0hjn.dhcp.thefacebook.com>
Date:   Mon, 22 Jun 2020 17:35:10 -0700
From:   Jakub Kicinski <kuba@...nel.org>
To:     Jeff Kirsher <jeffrey.t.kirsher@...el.com>
Cc:     davem@...emloft.net, Qian Cai <cai@....pw>, netdev@...r.kernel.org,
        nhorman@...hat.com, sassmann@...hat.com,
        Andrew Bowers <andrewx.bowers@...el.com>
Subject: Re: [net-next 9/9] i40e: silence an UBSAN false positive

On Mon, 22 Jun 2020 15:18:17 -0700 Jeff Kirsher wrote:
> From: Qian Cai <cai@....pw>
> 
> virtchnl_rss_lut.lut is used for the RSS lookup table, but in
> i40e_vc_config_rss_lut(), it is indexed by subscript results in a false
> positive.

This is commit message is not great either. The point is that we have a
pad[1] after the lut[1], and supposedly indexing second element of
lut[] is expected? Not sure why accessing pad is okay...

>  UBSAN: array-index-out-of-bounds in drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c:2983:15
>  index 1 is out of range for type 'u8 [1]'
>  CPU: 34 PID: 871 Comm: kworker/34:2 Not tainted 5.7.0-next-20200605+ #5
>  Hardware name: HPE ProLiant DL385 Gen10/ProLiant DL385 Gen10, BIOS A40 03/09/2018
>  Workqueue: i40e i40e_service_task [i40e]
>  Call Trace:
>   dump_stack+0xa7/0xea
>   ubsan_epilogue+0x9/0x45
>   __ubsan_handle_out_of_bounds+0x6f/0x80
>   i40e_vc_process_vf_msg+0x457c/0x4660 [i40e]
>   i40e_service_task+0x96c/0x1ab0 [i40e]
>   process_one_work+0x57d/0xbd0
>   worker_thread+0x63/0x5b0
>   kthread+0x20c/0x230
>   ret_from_fork+0x22/0x30
> 
> Fixes: d510497b8397 ("i40e: add input validation for virtchnl handlers")
> Signed-off-by: Qian Cai <cai@....pw>
> Tested-by: Andrew Bowers <andrewx.bowers@...el.com>
> Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@...el.com>
> ---
>  drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c | 5 +++--
>  1 file changed, 3 insertions(+), 2 deletions(-)
> 
> diff --git a/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c b/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c
> index 62132df0527e..5070b3a4b026 100644
> --- a/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c
> +++ b/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c
> @@ -3018,6 +3018,7 @@ static int i40e_vc_config_rss_lut(struct i40e_vf *vf, u8 *msg)
>  	struct i40e_vsi *vsi = NULL;
>  	i40e_status aq_ret = 0;
>  	u16 i;
> +	u8 *lut = vrl->lut;

reverse xmas tree

>  	if (!test_bit(I40E_VF_STATE_ACTIVE, &vf->vf_states) ||
>  	    !i40e_vc_isvalid_vsi_id(vf, vrl->vsi_id) ||