netdev - Re: [PATCH net] net: dsa: bcm_sf2: Fix array overrun in bcm_sf2_num_active

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <69b4ba48ff1278337048412d76574beb@milecki.pl>
Date:   Fri, 17 Sep 2021 20:09:07 +0200
From:   Rafał Miłecki <rafal@...ecki.pl>
To:     Florian Fainelli <f.fainelli@...il.com>
Cc:     netdev@...r.kernel.org, Andrew Lunn <andrew@...n.ch>,
        Vivien Didelot <vivien.didelot@...il.com>,
        Vladimir Oltean <olteanv@...il.com>,
        "David S. Miller" <davem@...emloft.net>,
        Jakub Kicinski <kuba@...nel.org>, linux-kernel@...r.kernel.org
Subject: Re: [PATCH net] net: dsa: bcm_sf2: Fix array overrun in
 bcm_sf2_num_active_ports()

On 2021-09-16 23:33, Florian Fainelli wrote:
> After d12e1c464988 ("net: dsa: b53: Set correct number of ports in the
> DSA struct") we stopped setting dsa_switch::num_ports to DSA_MAX_PORTS,
> which created an off by one error between the statically allocated
> bcm_sf2_priv::port_sts array (of size DSA_MAX_PORTS). When
> dsa_is_cpu_port() is used, we end-up accessing an out of bounds member
> and causing a NPD.
> 
> Fix this by iterating with the appropriate port count using
> ds->num_ports.
> 
> Fixes: d12e1c464988 ("net: dsa: b53: Set correct number of ports in
> the DSA struct")
> Signed-off-by: Florian Fainelli <f.fainelli@...il.com>

Tested-by: Rafał Miłecki <rafal@...ecki.pl>


This fixes:

[    0.515409] Unable to handle kernel read from unreadable memory at 
virtual address 0000000000000028
[    0.524659] Mem abort info:
[    0.527522]   ESR = 0x96000005
[    0.530656]   EC = 0x25: DABT (current EL), IL = 32 bits
[    0.536119]   SET = 0, FnV = 0
[    0.539262]   EA = 0, S1PTW = 0
[    0.542481] Data abort info:
[    0.545438]   ISV = 0, ISS = 0x00000005
[    0.549383]   CM = 0, WnR = 0
[    0.552427] [0000000000000028] user address but active_mm is swapper
[    0.558973] Internal error: Oops: 96000005 [#1] SMP
[    0.563986] Modules linked in:
[    0.567125] CPU: 1 PID: 24 Comm: kworker/1:1 Not tainted 5.10.64 #0
[    0.573573] Hardware name: Netgear R8000P (DT)
[    0.578155] Workqueue: events deferred_probe_work_func
[    0.583431] pstate: 60400005 (nZCv daif +PAN -UAO -TCO BTYPE=--)
[    0.589617] pc : bcm_sf2_recalc_clock+0x58/0xe4
[    0.594271] lr : bcm_sf2_port_setup+0xc0/0x2ac
[    0.598840] sp : ffffffc0109bb980
[    0.602244] x29: ffffffc0109bb980 x28: ffffff801fef6f60
[    0.607710] x27: ffffff8001242b30 x26: 0000000000039040
[    0.613175] x25: 0000000000002380 x24: 0000000000000003
[    0.618641] x23: ffffff800125f880 x22: 0000000000000003
[    0.624107] x21: 0000000000000000 x20: 0000000000000000
[    0.629572] x19: ffffff8001398280 x18: 0000002437b29c0a
[    0.635039] x17: 00008cad14430a3a x16: 0000000000000008
[    0.640503] x15: 0000000000000000 x14: 6863746977732d74
[    0.645969] x13: 656e72656874652e x12: 3030303038303038
[    0.651435] x11: 0002001d00000000 x10: 6d726f6674616c70
[    0.656900] x9 : ffffff800125f880 x8 : ffffff8001398800
[    0.662366] x7 : ffffff80013989b8 x6 : 0000000000000001
[    0.667832] x5 : ffffff800125f97c x4 : ffffff8001242b30
[    0.673297] x3 : 0000000000000009 x2 : ffffff8001242b30
[    0.678763] x1 : 0000000000000000 x0 : ffffff8001398280
[    0.684230] Call trace:
[    0.686740]  bcm_sf2_recalc_clock+0x58/0xe4