Messages in this thread | | | From | Michael Chan <> | Date | Wed, 18 Jan 2023 12:59:47 -0800 | Subject | Re: [PATCH] bnxt: Do not read past the end of test names |
| |
On Wed, Jan 18, 2023 at 12:35 PM Kees Cook <keescook@chromium.org> wrote: > > Test names were being concatenated based on a offset beyond the end of > the first name, which tripped the buffer overflow detection logic: > > detected buffer overflow in strnlen > [...] > Call Trace: > bnxt_ethtool_init.cold+0x18/0x18 > > Refactor struct hwrm_selftest_qlist_output to use an actual array, > and adjust the concatenation to use snprintf() rather than a series of > strncat() calls. > > Reported-by: Niklas Cassel <Niklas.Cassel@wdc.com> > Link: https://lore.kernel.org/lkml/Y8F%2F1w1AZTvLglFX@x1-carbon/ > Tested-by: Niklas Cassel <Niklas.Cassel@wdc.com> > Fixes: eb51365846bc ("bnxt_en: Add basic ethtool -t selftest support.") > Cc: Michael Chan <michael.chan@broadcom.com> > Cc: "David S. Miller" <davem@davemloft.net> > Cc: Eric Dumazet <edumazet@google.com> > Cc: Jakub Kicinski <kuba@kernel.org> > Cc: Paolo Abeni <pabeni@redhat.com> > Cc: netdev@vger.kernel.org > Signed-off-by: Kees Cook <keescook@chromium.org>
Reviewed-by: Michael Chan <michael.chan@broadcom.com>
> diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt_hsi.h b/drivers/net/ethernet/broadcom/bnxt/bnxt_hsi.h > index 2686a714a59f..a5408879e077 100644 > --- a/drivers/net/ethernet/broadcom/bnxt/bnxt_hsi.h > +++ b/drivers/net/ethernet/broadcom/bnxt/bnxt_hsi.h > @@ -10249,14 +10249,7 @@ struct hwrm_selftest_qlist_output { > u8 unused_0; > __le16 test_timeout; > u8 unused_1[2]; > - char test0_name[32]; > - char test1_name[32]; > - char test2_name[32]; > - char test3_name[32]; > - char test4_name[32]; > - char test5_name[32]; > - char test6_name[32]; > - char test7_name[32]; > + char test_name[8][32];
bnxt_hsi.h is a generated file. I will need to make a request so that future versions will be generated like this.
Thanks.
> u8 eyescope_target_BER_support; > #define SELFTEST_QLIST_RESP_EYESCOPE_TARGET_BER_SUPPORT_BER_1E8_SUPPORTED 0x0UL > #define SELFTEST_QLIST_RESP_EYESCOPE_TARGET_BER_SUPPORT_BER_1E9_SUPPORTED 0x1UL > -- > 2.34.1 > [unhandled content-type:application/pkcs7-signature] | |