lkml.org 
[lkml]   [2021]   [Jul]   [12]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
From
SubjectRe: [EXT] [PATCH] [net][atlantic] Fix buff_ring OOB in aq_ring_rx_clean
On Mon, Jul 12, 2021 at 06:33:37PM +0200, Igor Russkikh wrote:
> From code analysis, the only way how ->next could be overflowed - is a
> hardware malfunction/data corruption.
Yes. The unchecked index field is within a buffer ring, which I assume is a DMA region.
A faulty or compromised hardware could trigger the OOB bug. Leaving it undetected could
cause memory corruption, so the patch returns with I/O error.

> Software driver logic can't lead to that field overflow.
> I'm not sure how fuzzing can lead to that result.. Do you have any details?
The fuzzer we used is targeting the hardware input vector including MMIO and DMA.

> Even if it can, then we should also do a similar check in `if (buff->is_eop)` case below,
> since it also uses similar sequence to run through `next` pointers.
Thanks for pointing out. That should be checked too.

\
 
 \ /
  Last update: 2021-07-12 19:37    [W:2.128 / U:0.020 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site