mirror of
https://github.com/AuxXxilium/linux_dsm_epyc7002.git
synced 2025-01-24 01:40:06 +07:00
0f3086868e
Passing commands for logging to t4_record_mbox() with size
MBOX_LEN, when the actual command size is actually smaller,
causes out-of-bounds stack accesses in t4_record_mbox() while
copying command words here:
for (i = 0; i < size / 8; i++)
entry->cmd[i] = be64_to_cpu(cmd[i]);
Up to 48 bytes from the stack are then leaked to debugfs.
This happens whenever we send (and log) commands described by
structs fw_sched_cmd (32 bytes leaked), fw_vi_rxmode_cmd (48),
fw_hello_cmd (48), fw_bye_cmd (48), fw_initialize_cmd (48),
fw_reset_cmd (48), fw_pfvf_cmd (32), fw_eq_eth_cmd (16),
fw_eq_ctrl_cmd (32), fw_eq_ofld_cmd (32), fw_acl_mac_cmd(16),
fw_rss_glb_config_cmd(32), fw_rss_vi_config_cmd(32),
fw_devlog_cmd(32), fw_vi_enable_cmd(48), fw_port_cmd(32),
fw_sched_cmd(32), fw_devlog_cmd(32).
The cxgb4vf driver got this right instead.
When we call t4_record_mbox() to log a command reply, a MBOX_LEN
size can be used though, as get_mbox_rpl() will fill cmd_rpl up
completely.
Fixes:
|
||
|---|---|---|
| .. | ||
| 3com | ||
| 8390 | ||
| adaptec | ||
| adi | ||
| aeroflex | ||
| agere | ||
| alacritech | ||
| allwinner | ||
| alteon | ||
| altera | ||
| amazon | ||
| amd | ||
| apm | ||
| apple | ||
| aquantia | ||
| arc | ||
| atheros | ||
| aurora | ||
| broadcom | ||
| brocade | ||
| cadence | ||
| calxeda | ||
| cavium | ||
| chelsio | ||
| cirrus | ||
| cisco | ||
| davicom | ||
| dec | ||
| dlink | ||
| emulex | ||
| ezchip | ||
| faraday | ||
| freescale | ||
| fujitsu | ||
| hisilicon | ||
| hp | ||
| i825xx | ||
| ibm | ||
| intel | ||
| marvell | ||
| mediatek | ||
| mellanox | ||
| micrel | ||
| microchip | ||
| moxa | ||
| myricom | ||
| natsemi | ||
| neterion | ||
| netronome | ||
| nuvoton | ||
| nvidia | ||
| nxp | ||
| oki-semi | ||
| packetengines | ||
| pasemi | ||
| qlogic | ||
| qualcomm | ||
| rdc | ||
| realtek | ||
| renesas | ||
| rocker | ||
| samsung | ||
| seeq | ||
| sfc | ||
| sgi | ||
| silan | ||
| sis | ||
| smsc | ||
| stmicro | ||
| sun | ||
| synopsys | ||
| tehuti | ||
| ti | ||
| tile | ||
| toshiba | ||
| tundra | ||
| via | ||
| wiznet | ||
| xilinx | ||
| xircom | ||
| xscale | ||
| dnet.c | ||
| dnet.h | ||
| ec_bhf.c | ||
| ethoc.c | ||
| fealnx.c | ||
| jme.c | ||
| jme.h | ||
| Kconfig | ||
| korina.c | ||
| lantiq_etop.c | ||
| Makefile | ||
| netx-eth.c | ||