netdev - Re: [PATCH] qede: Fix memset corruption

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Tue, 24 Aug 2021 19:19:04 -0700
From:   Kees Cook <keescook@...omium.org>
To:     Shai Malin <smalin@...vell.com>
Cc:     netdev@...r.kernel.org, davem@...emloft.net, kuba@...nel.org,
        aelior@...vell.com, malin1024@...il.com,
        Prabhakar Kushwaha <pkushwaha@...vell.com>
Subject: Re: [PATCH] qede: Fix memset corruption

On Tue, Aug 24, 2021 at 07:52:49PM +0300, Shai Malin wrote:
> Thanks to Kees Cook who detected the problem of memset that starting
> from not the first member, but sized for the whole struct.
> The better change will be to remove the redundant memset and to clear
> only the msix_cnt member.

Okay, thanks. It wasn't clear if this needs to be _only_ the msix_cnt
member or something else.

> 
> Signed-off-by: Prabhakar Kushwaha <pkushwaha@...vell.com>
> Signed-off-by: Ariel Elior <aelior@...vell.com>
> Signed-off-by: Shai Malin <smalin@...vell.com>

Reported-by: Kees Cook <keescook@...omium.org>
Reviewed-by: Kees Cook <keescook@...omium.org>

-Kees

> ---
>  drivers/net/ethernet/qlogic/qede/qede_main.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/drivers/net/ethernet/qlogic/qede/qede_main.c b/drivers/net/ethernet/qlogic/qede/qede_main.c
> index d400e9b235bf..a0f20c5337d0 100644
> --- a/drivers/net/ethernet/qlogic/qede/qede_main.c
> +++ b/drivers/net/ethernet/qlogic/qede/qede_main.c
> @@ -1866,6 +1866,7 @@ static void qede_sync_free_irqs(struct qede_dev *edev)
>  	}
>  
>  	edev->int_info.used_cnt = 0;
> +	edev->int_info.msix_cnt = 0;
>  }
>  
>  static int qede_req_msix_irqs(struct qede_dev *edev)
> @@ -2419,7 +2420,6 @@ static int qede_load(struct qede_dev *edev, enum qede_load_mode mode,
>  	goto out;
>  err4:
>  	qede_sync_free_irqs(edev);
> -	memset(&edev->int_info.msix_cnt, 0, sizeof(struct qed_int_info));
>  err3:
>  	qede_napi_disable_remove(edev);
>  err2:
> -- 
> 2.22.0
> 

-- 
Kees Cook