lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  PHC 
Open Source and information security mailing list archives
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date:   Thu, 21 Apr 2022 12:53:21 -0700
From:   Grant Grundler <>
To:     Grant Grundler <>
Cc:     Igor Russkikh <>,
        Jakub Kicinski <>,
        Paolo Abeni <>,
        netdev <>,
        "David S . Miller" <>,
        LKML <>,
        Aashay Shringarpure <>,
        Yi Chou <>,
        Shervin Oloumi <>
Subject: Re: [PATCH 0/5] net: atlantic: more fuzzing fixes

Will you have a chance to comment on this in the near future?
Should someone else review/integrate these patches?

I'm asking since I've seen no comments in the past three days.


On Mon, Apr 18, 2022 at 4:17 PM Grant Grundler <> wrote:
> The Chrome OS fuzzing team posted a "Fuzzing" report for atlantic driver
> in Q4 2021 using Chrome OS v5.4 kernel and "Cable Matters
> Thunderbolt 3 to 10 Gb Ethernet" (b0 version):
> It essentially describes four problems:
> 1) validate rxd_wb->next_desc_ptr before populating buff->next
> 2) "frag[0] not initialized" case in aq_ring_rx_clean()
> 3) limit iterations handling fragments in aq_ring_rx_clean()
> 4) validate hw_head_ in hw_atl_b0_hw_ring_tx_head_update()
> I've added one "clean up" contribution:
>     "net: atlantic: reduce scope of is_rsc_complete"
> I tested the "original" patches using chromeos-v5.4 kernel branch:
> The fuzzing team will retest using the chromeos-v5.4 patches and the b0 HW.
> I've forward ported those patches to 5.18-rc2 and compiled them but am
> currently unable to test them on 5.18-rc2 kernel (logistics problems).
> I'm confident in all but the last patch:
>    "net: atlantic: verify hw_head_ is reasonable"
> Please verify I'm not confusing how ring->sw_head and ring->sw_tail
> are used in hw_atl_b0_hw_ring_tx_head_update().
> Credit largely goes to Chrome OS Fuzzing team members:
>     Aashay Shringarpure, Yi Chou, Shervin Oloumi
> cheers,
> grant

Powered by blists - more mailing lists