lkml.org 
[lkml]   [2020]   [May]   [5]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
From
Subject[BUG] net: chelsio: Possible buffer overflow caused by DMA failures/attacks
Date
In alloc_rx_resources():
    sge->respQ.entries =
        pci_alloc_consistent(pdev, size, &sge->respQ.dma_addr);

Thus, "sge->respQ.entries" is a DMA value, and it is assigned to
"e" in process_pure_responses():
    struct sge *sge = adapter->sge;
    struct respQ *q = &sge->respQ;
    struct respQ_e *e = &q->entries[q->cidx];

When DMA failures or attacks occur, the data stored in "e" can be
changed at any time. In this case, the value of "e->FreelistQid"
can be a large number to cause buffer overflow when the
following code is executed:
    const struct freelQ *fl = &sge->freelQ[e->FreelistQid];

Similarly, "sge->respQ.entries" is also assigned to "e" in
process_responses():
    struct sge *sge = adapter->sge;
    struct respQ *q = &sge->respQ;
    struct respQ_e *e = &q->entries[q->cidx];

When DMA failures or attacks occur, the data stored in "e" can be
changed at any time. In this case, the value of "e->FreelistQid"
can be a large number to cause buffer overflow when the
following code is executed:
    struct freelQ *fl = &sge->freelQ[e->FreelistQid];

Considering that DMA can fail or be attacked, I think that it is
dangerous to
use a DMA value (or any value tainted by it) as an array index or a
control-flow
condition. However, I have found many such dangerous cases in Linux
device drivers
through my static-analysis tool and code review.
I am not sure whether my opinion is correct, so I want to listen to your
points of view.
Thanks in advance :)


Best wishes,
Jia-Ju Bai

\
 
 \ /
  Last update: 2020-05-05 17:51    [W:0.024 / U:0.796 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site