* [PATCH net v2] qed: Fix stack corruption on probe
@ 2016-09-19 14:47 Yuval Mintz
2016-09-19 16:37 ` David Laight
2016-09-20 8:57 ` David Miller
0 siblings, 2 replies; 4+ messages in thread
From: Yuval Mintz @ 2016-09-19 14:47 UTC (permalink / raw)
To: davem, netdev; +Cc: David.Laight, Yuval Mintz, Yuval Mintz
Commit fe56b9e6a8d95 ("qed: Add module with basic common support")
has introduced a stack corruption during probe, where filling a
local struct with data to be sent to management firmware is incorrectly
filled; The data is written outside of the struct and corrupts
the stack.
Changes from v1:
----------------
- Correct the value written [Caught by David Laight]
Fixes: fe56b9e6a8d95 ("qed: Add module with basic common support")
Signed-off-by: Yuval Mintz <Yuval.Mintz@caviumnetworks.com>
---
Hi Dave,
Please consider applying this to `net'.
Thanks,
Yuval
---
drivers/net/ethernet/qlogic/qed/qed_mcp.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/net/ethernet/qlogic/qed/qed_mcp.c b/drivers/net/ethernet/qlogic/qed/qed_mcp.c
index a240f26..59c81ce 100644
--- a/drivers/net/ethernet/qlogic/qed/qed_mcp.c
+++ b/drivers/net/ethernet/qlogic/qed/qed_mcp.c
@@ -1153,8 +1153,8 @@ qed_mcp_send_drv_version(struct qed_hwfn *p_hwfn,
p_drv_version = &union_data.drv_version;
p_drv_version->version = p_ver->version;
- for (i = 0; i < MCP_DRV_VER_STR_SIZE - 1; i += 4) {
- val = cpu_to_be32(p_ver->name[i]);
+ for (i = 0; i < (MCP_DRV_VER_STR_SIZE - 4) / sizeof(u32); i++) {
+ val = cpu_to_be32(*((u32 *)&p_ver->name[i * sizeof(u32)]));
*(__be32 *)&p_drv_version->name[i * sizeof(u32)] = val;
}
--
1.9.3
^ permalink raw reply related [flat|nested] 4+ messages in thread
* RE: [PATCH net v2] qed: Fix stack corruption on probe
2016-09-19 14:47 [PATCH net v2] qed: Fix stack corruption on probe Yuval Mintz
@ 2016-09-19 16:37 ` David Laight
2016-09-19 17:24 ` Mintz, Yuval
2016-09-20 8:57 ` David Miller
1 sibling, 1 reply; 4+ messages in thread
From: David Laight @ 2016-09-19 16:37 UTC (permalink / raw)
To: 'Yuval Mintz', davem, netdev; +Cc: Yuval Mintz
From: Yuval Mintz
> Sent: 19 September 2016 15:48
> Commit fe56b9e6a8d95 ("qed: Add module with basic common support")
> has introduced a stack corruption during probe, where filling a
> local struct with data to be sent to management firmware is incorrectly
> filled; The data is written outside of the struct and corrupts
> the stack.
>
> Changes from v1:
> ----------------
> - Correct the value written [Caught by David Laight]
>
> Fixes: fe56b9e6a8d95 ("qed: Add module with basic common support")
> Signed-off-by: Yuval Mintz <Yuval.Mintz@caviumnetworks.com>
> ---
> Hi Dave,
>
> Please consider applying this to `net'.
>
> Thanks,
> Yuval
> ---
> drivers/net/ethernet/qlogic/qed/qed_mcp.c | 4 ++--
> 1 file changed, 2 insertions(+), 2 deletions(-)
>
> diff --git a/drivers/net/ethernet/qlogic/qed/qed_mcp.c b/drivers/net/ethernet/qlogic/qed/qed_mcp.c
> index a240f26..59c81ce 100644
> --- a/drivers/net/ethernet/qlogic/qed/qed_mcp.c
> +++ b/drivers/net/ethernet/qlogic/qed/qed_mcp.c
> @@ -1153,8 +1153,8 @@ qed_mcp_send_drv_version(struct qed_hwfn *p_hwfn,
> p_drv_version = &union_data.drv_version;
> p_drv_version->version = p_ver->version;
>
> - for (i = 0; i < MCP_DRV_VER_STR_SIZE - 1; i += 4) {
> - val = cpu_to_be32(p_ver->name[i]);
> + for (i = 0; i < (MCP_DRV_VER_STR_SIZE - 4) / sizeof(u32); i++) {
> + val = cpu_to_be32(*((u32 *)&p_ver->name[i * sizeof(u32)]));
> *(__be32 *)&p_drv_version->name[i * sizeof(u32)] = val;
> }
Or the much simpler:
/* Byteswap driver name */
for (i = 0; i < MCP_DRV_VER_STR_SIZE; i++)
p_drv_version->name[i ^ 3] = p_ver->name[i];
David
^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: [PATCH net v2] qed: Fix stack corruption on probe
2016-09-19 16:37 ` David Laight
@ 2016-09-19 17:24 ` Mintz, Yuval
0 siblings, 0 replies; 4+ messages in thread
From: Mintz, Yuval @ 2016-09-19 17:24 UTC (permalink / raw)
To: David Laight, 'Yuval Mintz', davem, netdev
> > Commit fe56b9e6a8d95 ("qed: Add module with basic common support")
> > has introduced a stack corruption during probe, where filling a
> > local struct with data to be sent to management firmware is incorrectly
> > filled; The data is written outside of the struct and corrupts
> > the stack.
> >
> > @@ -1153,8 +1153,8 @@ qed_mcp_send_drv_version(struct qed_hwfn *p_hwfn,
> > p_drv_version = &union_data.drv_version;
> > p_drv_version->version = p_ver->version;
> >
> > - for (i = 0; i < MCP_DRV_VER_STR_SIZE - 1; i += 4) {
> > - val = cpu_to_be32(p_ver->name[i]);
> > + for (i = 0; i < (MCP_DRV_VER_STR_SIZE - 4) / sizeof(u32); i++) {
> > + val = cpu_to_be32(*((u32 *)&p_ver->name[i * sizeof(u32)]));
> > *(__be32 *)&p_drv_version->name[i * sizeof(u32)] = val;
> > }
>
> Or the much simpler:
> /* Byteswap driver name */
> for (i = 0; i < MCP_DRV_VER_STR_SIZE; i++)
> p_drv_version->name[i ^ 3] = p_ver->name[i];
You're suggesting an unconditional swap; This will break
the message on a big endian machine [we'll swap needlessly].
^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: [PATCH net v2] qed: Fix stack corruption on probe
2016-09-19 14:47 [PATCH net v2] qed: Fix stack corruption on probe Yuval Mintz
2016-09-19 16:37 ` David Laight
@ 2016-09-20 8:57 ` David Miller
1 sibling, 0 replies; 4+ messages in thread
From: David Miller @ 2016-09-20 8:57 UTC (permalink / raw)
To: Yuval.Mintz; +Cc: netdev, David.Laight, Yuval.Mintz
From: Yuval Mintz <Yuval.Mintz@qlogic.com>
Date: Mon, 19 Sep 2016 17:47:41 +0300
> Commit fe56b9e6a8d95 ("qed: Add module with basic common support")
> has introduced a stack corruption during probe, where filling a
> local struct with data to be sent to management firmware is incorrectly
> filled; The data is written outside of the struct and corrupts
> the stack.
>
> Changes from v1:
> ----------------
> - Correct the value written [Caught by David Laight]
>
> Fixes: fe56b9e6a8d95 ("qed: Add module with basic common support")
> Signed-off-by: Yuval Mintz <Yuval.Mintz@caviumnetworks.com>
Applied, thanks.
^ permalink raw reply [flat|nested] 4+ messages in thread
end of thread, other threads:[~2016-09-20 8:57 UTC | newest]
Thread overview: 4+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2016-09-19 14:47 [PATCH net v2] qed: Fix stack corruption on probe Yuval Mintz
2016-09-19 16:37 ` David Laight
2016-09-19 17:24 ` Mintz, Yuval
2016-09-20 8:57 ` David Miller
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.