From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id C9231C433EF for ; Mon, 18 Apr 2022 23:18:02 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S234636AbiDRXUl (ORCPT ); Mon, 18 Apr 2022 19:20:41 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:39352 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S234591AbiDRXUi (ORCPT ); Mon, 18 Apr 2022 19:20:38 -0400 Received: from mail-qt1-x831.google.com (mail-qt1-x831.google.com [IPv6:2607:f8b0:4864:20::831]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 63BB423BC8 for ; Mon, 18 Apr 2022 16:17:57 -0700 (PDT) Received: by mail-qt1-x831.google.com with SMTP id t2so11101141qtw.9 for ; Mon, 18 Apr 2022 16:17:57 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=chromium.org; s=google; h=from:to:cc:subject:date:message-id:mime-version :content-transfer-encoding; bh=gV7UtmajIQUducVZbRr5/Bay12YbRA1rsedm6F/j0xI=; b=M0q72AcD9jfg+dANbrjyHrlpiw+otlCPC3XzOhu55g0oelda3LhwCOxsI7RPsfE08t 3qog70rS3rB1uw2/b749YJpqemXtQmY72xz+nPXSqczpIr4rs/yRwh2WfcSXUpHqxzzo s/HLNq4ZtgOuiSICTaKPyOUcwceY7Lt7dvYh0= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=x-gm-message-state:from:to:cc:subject:date:message-id:mime-version :content-transfer-encoding; bh=gV7UtmajIQUducVZbRr5/Bay12YbRA1rsedm6F/j0xI=; b=al1D5gQEsysF0+8vLqwWWbs1dBRMA17lv/1B29vzzqyvTqT7vt3dphoo6kKJDOk5+t ciAyA1UzRn5m9U9V9drW/XapijobrtFt231CDCbFaYFBFnJKhlB4WIFX4nEdsyvDi4DY wSQol/TXQxsQ17Htx9WqktHt5FuZ6eh12S4ahm8KqW8LQPazLapozbr9yXpopMdfBndv NFcgCD7RRVoSG41YtPvqdybQCO45kc2R9dimwNOPuBdcD5dwV0dsVcSD9KXk851DwcBD eQhsEYvU3IzY8/0jcE3dZ8MAnP/nHR5cMPgQK+zWZTu0fAnCQmOzVMhOR1HF27ZYn2OV xRuQ== X-Gm-Message-State: AOAM532p8X5jsuLBNaYQ+705vFWWpkpBpZJg4TYiI/wIV1wcJxfYq1gm 8XfnYu2ZsK06mbTF7IcLuJKK1g== X-Google-Smtp-Source: ABdhPJzH71KiFd0XgGFFJT13Z9K5HJ1+NRM6zFLxHEeOW6BBln/hR2wG3NyC9DFPKGe+vfPXcGk5lg== X-Received: by 2002:ac8:5dca:0:b0:2f1:fcc6:d85a with SMTP id e10-20020ac85dca000000b002f1fcc6d85amr5238941qtx.72.1650323876585; Mon, 18 Apr 2022 16:17:56 -0700 (PDT) Received: from grundler-glapstation.lan ([70.134.62.80]) by smtp.gmail.com with ESMTPSA id a1-20020a05622a02c100b002f17cba4930sm8214048qtx.85.2022.04.18.16.17.54 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 18 Apr 2022 16:17:55 -0700 (PDT) From: Grant Grundler To: Igor Russkikh Cc: Jakub Kicinski , Paolo Abeni , netdev , "David S . Miller" , LKML , Aashay Shringarpure , Yi Chou , Shervin Oloumi , Grant Grundler Subject: [PATCH 0/5] net: atlantic: more fuzzing fixes Date: Mon, 18 Apr 2022 16:17:41 -0700 Message-Id: <20220418231746.2464800-1-grundler@chromium.org> X-Mailer: git-send-email 2.36.0.rc0.470.gd361397f0d-goog MIME-Version: 1.0 Content-Transfer-Encoding: 8bit Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org The Chrome OS fuzzing team posted a "Fuzzing" report for atlantic driver in Q4 2021 using Chrome OS v5.4 kernel and "Cable Matters Thunderbolt 3 to 10 Gb Ethernet" (b0 version): https://docs.google.com/document/d/e/2PACX-1vT4oCGNhhy_AuUqpu6NGnW0N9HF_jxf2kS7raOpOlNRqJNiTHAtjiHRthXYSeXIRTgfeVvsEt0qK9qK/pub It essentially describes four problems: 1) validate rxd_wb->next_desc_ptr before populating buff->next 2) "frag[0] not initialized" case in aq_ring_rx_clean() 3) limit iterations handling fragments in aq_ring_rx_clean() 4) validate hw_head_ in hw_atl_b0_hw_ring_tx_head_update() I've added one "clean up" contribution: "net: atlantic: reduce scope of is_rsc_complete" I tested the "original" patches using chromeos-v5.4 kernel branch: https://chromium-review.googlesource.com/q/hashtag:pcinet-atlantic-2022q1+(status:open%20OR%20status:merged) The fuzzing team will retest using the chromeos-v5.4 patches and the b0 HW. I've forward ported those patches to 5.18-rc2 and compiled them but am currently unable to test them on 5.18-rc2 kernel (logistics problems). I'm confident in all but the last patch: "net: atlantic: verify hw_head_ is reasonable" Please verify I'm not confusing how ring->sw_head and ring->sw_tail are used in hw_atl_b0_hw_ring_tx_head_update(). Credit largely goes to Chrome OS Fuzzing team members: Aashay Shringarpure, Yi Chou, Shervin Oloumi cheers, grant