All of lore.kernel.org
 help / color / mirror / Atom feed
From: Grant Grundler <grundler@chromium.org>
To: Igor Russkikh <irusskikh@marvell.com>
Cc: Jakub Kicinski <kuba@kernel.org>, Paolo Abeni <pabeni@redhat.com>,
	netdev <netdev@vger.kernel.org>,
	"David S . Miller" <davem@davemloft.net>,
	LKML <linux-kernel@vger.kernel.org>,
	Aashay Shringarpure <aashay@google.com>,
	Yi Chou <yich@google.com>,
	Shervin Oloumi <enlightened@google.com>,
	Grant Grundler <grundler@chromium.org>
Subject: [PATCH 0/5] net: atlantic: more fuzzing fixes
Date: Mon, 18 Apr 2022 16:17:41 -0700	[thread overview]
Message-ID: <20220418231746.2464800-1-grundler@chromium.org> (raw)

The Chrome OS fuzzing team posted a "Fuzzing" report for atlantic driver
in Q4 2021 using Chrome OS v5.4 kernel and "Cable Matters
Thunderbolt 3 to 10 Gb Ethernet" (b0 version):
    https://docs.google.com/document/d/e/2PACX-1vT4oCGNhhy_AuUqpu6NGnW0N9HF_jxf2kS7raOpOlNRqJNiTHAtjiHRthXYSeXIRTgfeVvsEt0qK9qK/pub

It essentially describes four problems:
1) validate rxd_wb->next_desc_ptr before populating buff->next
2) "frag[0] not initialized" case in aq_ring_rx_clean()
3) limit iterations handling fragments in aq_ring_rx_clean()
4) validate hw_head_ in hw_atl_b0_hw_ring_tx_head_update()

I've added one "clean up" contribution:
    "net: atlantic: reduce scope of is_rsc_complete"

I tested the "original" patches using chromeos-v5.4 kernel branch:
    https://chromium-review.googlesource.com/q/hashtag:pcinet-atlantic-2022q1+(status:open%20OR%20status:merged)

The fuzzing team will retest using the chromeos-v5.4 patches and the b0 HW.

I've forward ported those patches to 5.18-rc2 and compiled them but am
currently unable to test them on 5.18-rc2 kernel (logistics problems).

I'm confident in all but the last patch:
   "net: atlantic: verify hw_head_ is reasonable"

Please verify I'm not confusing how ring->sw_head and ring->sw_tail
are used in hw_atl_b0_hw_ring_tx_head_update().

Credit largely goes to Chrome OS Fuzzing team members:
    Aashay Shringarpure, Yi Chou, Shervin Oloumi

cheers,
grant

             reply	other threads:[~2022-04-18 23:18 UTC|newest]

Thread overview: 15+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2022-04-18 23:17 Grant Grundler [this message]
2022-04-18 23:17 ` [PATCH 1/5] net: atlantic: limit buff_ring index value Grant Grundler
2022-04-18 23:17 ` [PATCH 2/5] net: atlantic: fix "frag[0] not initialized" Grant Grundler
2022-04-18 23:17 ` [PATCH 3/5] net: atlantic: reduce scope of is_rsc_complete Grant Grundler
2022-04-18 23:17 ` [PATCH 4/5] net: atlantic: add check for MAX_SKB_FRAGS Grant Grundler
2022-04-18 23:17 ` [PATCH 5/5] net: atlantic: verify hw_head_ is reasonable Grant Grundler
2022-04-21 19:53 ` [PATCH 0/5] net: atlantic: more fuzzing fixes Grant Grundler
2022-04-26 16:00   ` [EXT] " Igor Russkikh
2022-04-26 17:20     ` Grant Grundler
2022-05-03 11:14       ` Dmitrii Bezrukov
2022-05-03 18:07         ` Grant Grundler
2022-05-04 14:39           ` Dmitrii Bezrukov
2022-05-04 20:11             ` Grant Grundler
2022-05-05  7:11               ` Igor Russkikh
2022-05-05 20:57                 ` Grant Grundler

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20220418231746.2464800-1-grundler@chromium.org \
    --to=grundler@chromium.org \
    --cc=aashay@google.com \
    --cc=davem@davemloft.net \
    --cc=enlightened@google.com \
    --cc=irusskikh@marvell.com \
    --cc=kuba@kernel.org \
    --cc=linux-kernel@vger.kernel.org \
    --cc=netdev@vger.kernel.org \
    --cc=pabeni@redhat.com \
    --cc=yich@google.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.