mirror of https://gitee.com/openkylin/linux.git
0f3086868e
Passing commands for logging to t4_record_mbox() with size
MBOX_LEN, when the actual command size is actually smaller,
causes out-of-bounds stack accesses in t4_record_mbox() while
copying command words here:
for (i = 0; i < size / 8; i++)
entry->cmd[i] = be64_to_cpu(cmd[i]);
Up to 48 bytes from the stack are then leaked to debugfs.
This happens whenever we send (and log) commands described by
structs fw_sched_cmd (32 bytes leaked), fw_vi_rxmode_cmd (48),
fw_hello_cmd (48), fw_bye_cmd (48), fw_initialize_cmd (48),
fw_reset_cmd (48), fw_pfvf_cmd (32), fw_eq_eth_cmd (16),
fw_eq_ctrl_cmd (32), fw_eq_ofld_cmd (32), fw_acl_mac_cmd(16),
fw_rss_glb_config_cmd(32), fw_rss_vi_config_cmd(32),
fw_devlog_cmd(32), fw_vi_enable_cmd(48), fw_port_cmd(32),
fw_sched_cmd(32), fw_devlog_cmd(32).
The cxgb4vf driver got this right instead.
When we call t4_record_mbox() to log a command reply, a MBOX_LEN
size can be used though, as get_mbox_rpl() will fill cmd_rpl up
completely.
Fixes:
|
||
|---|---|---|
| .. | ||
| Makefile | ||
| clip_tbl.c | ||
| clip_tbl.h | ||
| cxgb4.h | ||
| cxgb4_dcb.c | ||
| cxgb4_dcb.h | ||
| cxgb4_debugfs.c | ||
| cxgb4_debugfs.h | ||
| cxgb4_ethtool.c | ||
| cxgb4_fcoe.c | ||
| cxgb4_fcoe.h | ||
| cxgb4_filter.c | ||
| cxgb4_filter.h | ||
| cxgb4_main.c | ||
| cxgb4_ptp.c | ||
| cxgb4_ptp.h | ||
| cxgb4_tc_u32.c | ||
| cxgb4_tc_u32.h | ||
| cxgb4_tc_u32_parse.h | ||
| cxgb4_uld.c | ||
| cxgb4_uld.h | ||
| l2t.c | ||
| l2t.h | ||
| sched.c | ||
| sched.h | ||
| sge.c | ||
| t4_chip_type.h | ||
| t4_hw.c | ||
| t4_hw.h | ||
| t4_msg.h | ||
| t4_pci_id_tbl.h | ||
| t4_regs.h | ||
| t4_values.h | ||
| t4fw_api.h | ||
| t4fw_version.h | ||