netdev - Re: [PATCH v2] ptp: ocp: Limit SMA/signal/freq counts in show/store functions

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <CAMuE1bGWAoF-=6NNuNqFRymhYeg=Ah6dPmTx7vyZUD9yM8jwPA@mail.gmail.com>
Date: Wed, 14 May 2025 09:36:40 +0300
From: Sagi Maimon <maimon.sagi@...il.com>
To: Jakub Kicinski <kuba@...nel.org>
Cc: jonathan.lemon@...il.com, vadim.fedorenko@...ux.dev, 
	richardcochran@...il.com, andrew+netdev@...n.ch, davem@...emloft.net, 
	edumazet@...gle.com, pabeni@...hat.com, linux-kernel@...r.kernel.org, 
	netdev@...r.kernel.org
Subject: Re: [PATCH v2] ptp: ocp: Limit SMA/signal/freq counts in show/store functions

On Tue, May 13, 2025 at 3:07 AM Jakub Kicinski <kuba@...nel.org> wrote:
>
> On Sun, 11 May 2025 17:39:08 +0300 Sagi Maimon wrote:
> > > > > What do you mean by out-of-bounds access here. Is there any access with
> > > > > index > 4 possible? Or just with index > 1 for Adva?
> >
> > The sysfs interface restricts indices to a maximum of 4; however,
> > since an array of 4 signals/frequencies is always created and fully
> > accessible via sysfs—regardless of the actual number initialized—this
> > bug impacts any board that initializes fewer than 4
> > signals/frequencies.
>
> Right, but the bug is that user may write to registers which don't
> exist? Or something will crash? We need to give backporters more info
> about the impact of this bug. Can this crash the kernel?
>
it can not crash the kernel, it avoks kernel Oops (page_fault_oops),
the kernel the kernel recovering by terminating the process.
It will be added to the commit note.
> As for sysfs exposing 4 entries, I think it's controlled by what groups
> of attributes are added. So I think were possible we should create
> attribute groups with only 2 entries for Adva. Eg. copy
> fb_timecard_groups[] with just the correct entries, and in
> ptp_ocp_fb_board_init() add an if which selects the right array.
you are right (look at Vadim's reply too)
Adva has adva_timecard_groups with the correct entries, so the fix is
relevant only for signal_summary_show
and _frequency_summary_show