[PATCH net] cxgb3: fix out of bounds read

[PATCH net] cxgb3: fix out of bounds read

[Michal Schmidt]

An out of bounds read of 2 bytes was discovered in cxgb3 with KASAN.

t3_config_rss() expects both arrays it gets as parameters to have
terminators. setup_rss(), the caller, forgets to add a terminator to
one of the arrays. Thankfully the iteration in t3_config_rss() stops
anyway, but in the last iteration the check for the terminator
is an out of bounds read.

Add the missing terminator to rspq_map[].

Reported-by: Jan Stancek <jstancek@redhat.com>
Signed-off-by: Michal Schmidt <mschmidt@redhat.com>
---
 drivers/net/ethernet/chelsio/cxgb3/cxgb3_main.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/net/ethernet/chelsio/cxgb3/cxgb3_main.c b/drivers/net/ethernet/chelsio/cxgb3/cxgb3_main.c
index 60908eab3b..43da891fab 100644
--- a/drivers/net/ethernet/chelsio/cxgb3/cxgb3_main.c
+++ b/drivers/net/ethernet/chelsio/cxgb3/cxgb3_main.c
@@ -576,7 +576,7 @@ static void setup_rss(struct adapter *adap)
 	unsigned int nq0 = adap2pinfo(adap, 0)->nqsets;
 	unsigned int nq1 = adap->port[1] ? adap2pinfo(adap, 1)->nqsets : 1;
 	u8 cpus[SGE_QSETS + 1];
-	u16 rspq_map[RSS_TABLE_SIZE];
+	u16 rspq_map[RSS_TABLE_SIZE + 1];
 
 	for (i = 0; i < SGE_QSETS; ++i)
 		cpus[i] = i;
@@ -586,6 +586,7 @@ static void setup_rss(struct adapter *adap)
 		rspq_map[i] = i % nq0;
 		rspq_map[i + RSS_TABLE_SIZE / 2] = (i % nq1) + nq0;
 	}
+	rspq_map[RSS_TABLE_SIZE] = 0xffff; /* terminator */
 
 	t3_config_rss(adap, F_RQFEEDBACKENABLE | F_TNLLKPEN | F_TNLMAPEN |
 		      F_TNLPRTEN | F_TNL2TUPEN | F_TNL4TUPEN |
-- 
2.7.4

Re: [PATCH net] cxgb3: fix out of bounds read

[David Miller]

From: Michal Schmidt <mschmidt@redhat.com>
Date: Fri, 29 Apr 2016 11:06:50 +0200

> An out of bounds read of 2 bytes was discovered in cxgb3 with KASAN.
> 
> t3_config_rss() expects both arrays it gets as parameters to have
> terminators. setup_rss(), the caller, forgets to add a terminator to
> one of the arrays. Thankfully the iteration in t3_config_rss() stops
> anyway, but in the last iteration the check for the terminator
> is an out of bounds read.
> 
> Add the missing terminator to rspq_map[].
> 
> Reported-by: Jan Stancek <jstancek@redhat.com>
> Signed-off-by: Michal Schmidt <mschmidt@redhat.com>

Applied.

Re: [PATCH net] cxgb3: fix out of bounds read

[Jan Stancek]

----- Original Message -----
> From: "David Miller" <davem@davemloft.net>
> To: mschmidt@redhat.com
> Cc: netdev@vger.kernel.org, santosh@chelsio.com, jstancek@redhat.com
> Sent: Monday, 2 May, 2016 3:00:00 AM
> Subject: Re: [PATCH net] cxgb3: fix out of bounds read
> 
> From: Michal Schmidt <mschmidt@redhat.com>
> Date: Fri, 29 Apr 2016 11:06:50 +0200
> 
> > An out of bounds read of 2 bytes was discovered in cxgb3 with KASAN.
> > 
> > t3_config_rss() expects both arrays it gets as parameters to have
> > terminators. setup_rss(), the caller, forgets to add a terminator to
> > one of the arrays. Thankfully the iteration in t3_config_rss() stops
> > anyway, but in the last iteration the check for the terminator
> > is an out of bounds read.
> > 
> > Add the missing terminator to rspq_map[].
> > 
> > Reported-by: Jan Stancek <jstancek@redhat.com>
> > Signed-off-by: Michal Schmidt <mschmidt@redhat.com>
> 
> Applied.
> 

KASAN BUG message went away for me with this patch.

Regards,
Jan