netdev - Re: [PATCH net] ethtool: cmis_cdb: Fix incorrect read / write length extension

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <874iywxv9u.fsf@nvidia.com>
Date: Thu, 10 Apr 2025 10:41:40 +0200
From: Petr Machata <petrm@...dia.com>
To: Ido Schimmel <idosch@...dia.com>
CC: <netdev@...r.kernel.org>, <davem@...emloft.net>, <kuba@...nel.org>,
	<pabeni@...hat.com>, <edumazet@...gle.com>, <horms@...nel.org>,
	<danieller@...dia.com>, <petrm@...dia.com>, <andrew@...n.ch>,
	<damodharam.ammepalli@...adcom.com>, <michael.chan@...adcom.com>,
	<andrew.gospodarek@...adcom.com>
Subject: Re: [PATCH net] ethtool: cmis_cdb: Fix incorrect read / write
 length extension


Ido Schimmel <idosch@...dia.com> writes:

> The 'read_write_len_ext' field in 'struct ethtool_cmis_cdb_cmd_args'
> stores the maximum number of bytes that can be read from or written to
> the Local Payload (LPL) page in a single multi-byte access.
>
> Cited commit started overwriting this field with the maximum number of
> bytes that can be read from or written to the Extended Payload (LPL)
> pages in a single multi-byte access. Transceiver modules that support
> auto paging can advertise a number larger than 255 which is problematic
> as 'read_write_len_ext' is a 'u8', resulting in the number getting
> truncated and firmware flashing failing [1].
>
> Fix by ignoring the maximum EPL access size as the kernel does not
> currently support auto paging (even if the transceiver module does) and
> will not try to read / write more than 128 bytes at once.
>
> [1]
> Transceiver module firmware flashing started for device enp177s0np0
> Transceiver module firmware flashing in progress for device enp177s0np0
> Progress: 0%
> Transceiver module firmware flashing encountered an error for device enp177s0np0
> Status message: Write FW block EPL command failed, LPL length is longer
> 	than CDB read write length extension allows.
>
> Fixes: 9a3b0d078bd8 ("net: ethtool: Add support for writing firmware blocks using EPL payload")
> Reported-by: Damodharam Ammepalli <damodharam.ammepalli@...adcom.com>
> Closes: https://lore.kernel.org/netdev/20250402183123.321036-3-michael.chan@broadcom.com/
> Tested-by: Damodharam Ammepalli <damodharam.ammepalli@...adcom.com>
> Signed-off-by: Ido Schimmel <idosch@...dia.com>

Reviewed-by: Petr Machata <petrm@...dia.com>