netdev - RE: [Intel-wired-lan][PATCH iwl-net] idpf: use actual mbx receive payload length

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <MW4PR11MB5911B25C951EDEEE19A4BA61BA682@MW4PR11MB5911.namprd11.prod.outlook.com>
Date: Tue, 24 Sep 2024 23:14:45 +0000
From: "Singh, Krishneil K" <krishneil.k.singh@...el.com>
To: "Hay, Joshua A" <joshua.a.hay@...el.com>,
	"intel-wired-lan@...ts.osuosl.org" <intel-wired-lan@...ts.osuosl.org>
CC: "Olech, Milena" <milena.olech@...el.com>, "Lobakin, Aleksander"
	<aleksander.lobakin@...el.com>, "netdev@...r.kernel.org"
	<netdev@...r.kernel.org>, "Hay, Joshua A" <joshua.a.hay@...el.com>,
	"stable@...r.kernel.org" <stable@...r.kernel.org>, "Kitszel, Przemyslaw"
	<przemyslaw.kitszel@...el.com>
Subject: RE: [Intel-wired-lan][PATCH iwl-net] idpf: use actual mbx receive
 payload length

> -----Original Message-----
> From: Joshua Hay <joshua.a.hay@...el.com>
> Sent: Tuesday, September 3, 2024 11:50 AM
> To: intel-wired-lan@...ts.osuosl.org
> Cc: Olech, Milena <milena.olech@...el.com>; Lobakin, Aleksander
> <aleksander.lobakin@...el.com>; netdev@...r.kernel.org; Hay, Joshua A
> <joshua.a.hay@...el.com>; stable@...r.kernel.org; Kitszel, Przemyslaw
> <przemyslaw.kitszel@...el.com>
> Subject: [Intel-wired-lan][PATCH iwl-net] idpf: use actual mbx receive payload
> length
> 
> When a mailbox message is received, the driver is checking for a non 0
> datalen in the controlq descriptor. If it is valid, the payload is
> attached to the ctlq message to give to the upper layer.  However, the
> payload response size given to the upper layer was taken from the buffer
> metadata which is _always_ the max buffer size. This meant the API was
> returning 4K as the payload size for all messages.  This went unnoticed
> since the virtchnl exchange response logic was checking for a response
> size less than 0 (error), not less than exact size, or not greater than
> or equal to the max mailbox buffer size (4K). All of these checks will
> pass in the success case since the size provided is always 4K. However,
> this breaks anyone that wants to validate the exact response size.
> 
> Fetch the actual payload length from the value provided in the
> descriptor data_len field (instead of the buffer metadata).
> 
> Unfortunately, this means we lose some extra error parsing for variable
> sized virtchnl responses such as create vport and get ptypes.  However,
> the original checks weren't really helping anyways since the size was
> _always_ 4K.
> 
> Fixes: 34c21fa894a1 ("idpf: implement virtchnl transaction manager")
> Cc: stable@...r.kernel.org # 6.9+
> Signed-off-by: Joshua Hay <joshua.a.hay@...el.com>
> Reviewed-by: Przemek Kitszel <przemyslaw.kitszel@...el.com>
> ---
>  drivers/net/ethernet/intel/idpf/idpf_virtchnl.c | 9 +--------
>  1 file changed, 1 insertion(+), 8 deletions(-)
> 
> diff --git a/drivers/net/ethernet/intel/idpf/idpf_virtchnl.c
> b/drivers/net/ethernet/intel/idpf/idpf_virtchnl.c
> index 70986e12da28..3c0f97650d72 100644
> --- a/drivers/net/ethernet/intel/idpf/idpf_virtchnl.c
> +++ b/drivers/net/ethernet/intel/idpf/idpf_virtchnl.c

Tested-by: Krishneil Singh <krishneil.k.singh@...el.com>