* [BUG] net: chelsio: Possible buffer overflow caused by DMA failures/attacks
@ 2020-05-05 15:50 Jia-Ju Bai
2020-05-05 17:02 ` Greg KH
0 siblings, 1 reply; 2+ messages in thread
From: Jia-Ju Bai @ 2020-05-05 15:50 UTC (permalink / raw)
To: davem, gregkh, kuba, christophe.jaillet, leon, tglx; +Cc: netdev, linux-kernel
In alloc_rx_resources():
sge->respQ.entries =
pci_alloc_consistent(pdev, size, &sge->respQ.dma_addr);
Thus, "sge->respQ.entries" is a DMA value, and it is assigned to
"e" in process_pure_responses():
struct sge *sge = adapter->sge;
struct respQ *q = &sge->respQ;
struct respQ_e *e = &q->entries[q->cidx];
When DMA failures or attacks occur, the data stored in "e" can be
changed at any time. In this case, the value of "e->FreelistQid"
can be a large number to cause buffer overflow when the
following code is executed:
const struct freelQ *fl = &sge->freelQ[e->FreelistQid];
Similarly, "sge->respQ.entries" is also assigned to "e" in
process_responses():
struct sge *sge = adapter->sge;
struct respQ *q = &sge->respQ;
struct respQ_e *e = &q->entries[q->cidx];
When DMA failures or attacks occur, the data stored in "e" can be
changed at any time. In this case, the value of "e->FreelistQid"
can be a large number to cause buffer overflow when the
following code is executed:
struct freelQ *fl = &sge->freelQ[e->FreelistQid];
Considering that DMA can fail or be attacked, I think that it is
dangerous to
use a DMA value (or any value tainted by it) as an array index or a
control-flow
condition. However, I have found many such dangerous cases in Linux
device drivers
through my static-analysis tool and code review.
I am not sure whether my opinion is correct, so I want to listen to your
points of view.
Thanks in advance :)
Best wishes,
Jia-Ju Bai
^ permalink raw reply [flat|nested] 2+ messages in thread
* Re: [BUG] net: chelsio: Possible buffer overflow caused by DMA failures/attacks
2020-05-05 15:50 [BUG] net: chelsio: Possible buffer overflow caused by DMA failures/attacks Jia-Ju Bai
@ 2020-05-05 17:02 ` Greg KH
0 siblings, 0 replies; 2+ messages in thread
From: Greg KH @ 2020-05-05 17:02 UTC (permalink / raw)
To: Jia-Ju Bai
Cc: davem, kuba, christophe.jaillet, leon, tglx, netdev, linux-kernel
On Tue, May 05, 2020 at 11:50:28PM +0800, Jia-Ju Bai wrote:
> In alloc_rx_resources():
> sge->respQ.entries =
> pci_alloc_consistent(pdev, size, &sge->respQ.dma_addr);
>
> Thus, "sge->respQ.entries" is a DMA value, and it is assigned to
> "e" in process_pure_responses():
> struct sge *sge = adapter->sge;
> struct respQ *q = &sge->respQ;
> struct respQ_e *e = &q->entries[q->cidx];
>
> When DMA failures or attacks occur, the data stored in "e" can be
> changed at any time. In this case, the value of "e->FreelistQid"
> can be a large number to cause buffer overflow when the
> following code is executed:
> const struct freelQ *fl = &sge->freelQ[e->FreelistQid];
>
> Similarly, "sge->respQ.entries" is also assigned to "e" in
> process_responses():
> struct sge *sge = adapter->sge;
> struct respQ *q = &sge->respQ;
> struct respQ_e *e = &q->entries[q->cidx];
>
> When DMA failures or attacks occur, the data stored in "e" can be
> changed at any time. In this case, the value of "e->FreelistQid"
> can be a large number to cause buffer overflow when the
> following code is executed:
> struct freelQ *fl = &sge->freelQ[e->FreelistQid];
>
> Considering that DMA can fail or be attacked, I think that it is dangerous
> to
> use a DMA value (or any value tainted by it) as an array index or a
> control-flow
> condition. However, I have found many such dangerous cases in Linux device
> drivers
> through my static-analysis tool and code review.
> I am not sure whether my opinion is correct, so I want to listen to your
> points of view.
Can you create a patch to show what you think needs to be fixed? That's
the best way to get feedback, reports like this are usually very
infrequently replied to.
thanks,
greg k-h
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2020-05-05 17:02 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2020-05-05 15:50 [BUG] net: chelsio: Possible buffer overflow caused by DMA failures/attacks Jia-Ju Bai
2020-05-05 17:02 ` Greg KH
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).