All of lore.kernel.org
 help / color / mirror / Atom feed
From: Jonathan Toppins <jtoppins@cumulusnetworks.com>
To: intel-wired-lan@osuosl.org
Subject: [Intel-wired-lan] [PATCH v1 net-next 2/2] igb: support SIOCSMIIREG
Date: Fri, 08 May 2015 12:57:48 -0400	[thread overview]
Message-ID: <554CEB0C.40308@cumulusnetworks.com> (raw)
In-Reply-To: <93C443E7-4209-45A3-A54F-949A4ECDD508@intel.com>

On 5/7/15 4:46 PM, Rustad, Mark D wrote:
>> On May 7, 2015, at 10:52 AM, Alexander Duyck <alexander.duyck@gmail.com> wrote:
>>
>>> diff --git a/drivers/net/ethernet/intel/igb/igb_main.c b/drivers/net/ethernet/intel/igb/igb_main.c
>>> index 720b785..1071a71 100644
>>> --- a/drivers/net/ethernet/intel/igb/igb_main.c
>>> +++ b/drivers/net/ethernet/intel/igb/igb_main.c
>>> @@ -7141,6 +7141,11 @@ static int igb_mii_ioctl(struct net_device *netdev, struct ifreq *ifr, int cmd)
>>>   			return -EIO;
>>>   		break;
>>>   	case SIOCSMIIREG:
>>> +		adapter->hw.phy.addr = data->phy_id;
>>> +		if (igb_write_phy_reg(&adapter->hw, data->reg_num & 0x1F,
>>> +				      data->val_in))
>>> +			return -EIO;
>>> +		break;
>>>   	default:
>>>   		return -EOPNOTSUPP;
>>>   	}
>>
>> How and why is this being used?  From what I can tell it looks like it is an easy way to break any of the existing interfaces if it is misused since all you would need to do is specify a phy address that doesn't match the existing PHY in the system and then you would likely lose link, or possibly mess up the configuration on the system requiring.
>>
>> I suspect this is a back door for some piece of user space code that is being given far more permission than it should be.
>
> I don't know about a back door, but the real problem is that it has a
> side-effect of changing the saved value of the phy addr. That is clearly
> a problem and can't be allowed.

This patch was worse before... it had changes in SIOGMIIREG that had 
similar side-effects, missed this one.

Checking with some of the platform people here this patch can be 
dropped. We don't use it as a backdoor of any kind it was mainly used 
for debugging/guess-what-the-phy-addr-was when we originally got the boards.
>
> For the phylib stuff to really work as intended, the igb_write_phy_reg
> really should take the phy address as a parameter instead of getting
> the value from the structure itself. Or a new function should be
> defined that has that interface.
>
> --
> Mark Rustad, Networking Division, Intel Corporation
>


WARNING: multiple messages have this Message-ID (diff)
From: Jonathan Toppins <jtoppins@cumulusnetworks.com>
To: "Rustad, Mark D" <mark.d.rustad@intel.com>,
	Alexander Duyck <alexander.duyck@gmail.com>
Cc: "Kirsher, Jeffrey T" <jeffrey.t.kirsher@intel.com>,
	"Brandeburg, Jesse" <jesse.brandeburg@intel.com>,
	"Nelson, Shannon" <shannon.nelson@intel.com>,
	"Wyborny, Carolyn" <carolyn.wyborny@intel.com>,
	"Skidmore, Donald C" <donald.c.skidmore@intel.com>,
	"Vick, Matthew" <matthew.vick@intel.com>,
	"Ronciak, John" <john.ronciak@intel.com>,
	"Williams, Mitch A" <mitch.a.williams@intel.com>,
	"intel-wired-lan@lists.osuosl.org"
	<intel-wired-lan@lists.osuosl.org>,
	"netdev@vger.kernel.org" <netdev@vger.kernel.org>,
	"gospo@cumulusnetworks.com" <gospo@cumulusnetworks.com>,
	"shm@cumulusnetworks.com" <shm@cumulusnetworks.com>,
	Alan Liebthal <alanl@cumulusnetworks.com>
Subject: Re: [PATCH v1 net-next 2/2] igb: support SIOCSMIIREG
Date: Fri, 08 May 2015 12:57:48 -0400	[thread overview]
Message-ID: <554CEB0C.40308@cumulusnetworks.com> (raw)
In-Reply-To: <93C443E7-4209-45A3-A54F-949A4ECDD508@intel.com>

On 5/7/15 4:46 PM, Rustad, Mark D wrote:
>> On May 7, 2015, at 10:52 AM, Alexander Duyck <alexander.duyck@gmail.com> wrote:
>>
>>> diff --git a/drivers/net/ethernet/intel/igb/igb_main.c b/drivers/net/ethernet/intel/igb/igb_main.c
>>> index 720b785..1071a71 100644
>>> --- a/drivers/net/ethernet/intel/igb/igb_main.c
>>> +++ b/drivers/net/ethernet/intel/igb/igb_main.c
>>> @@ -7141,6 +7141,11 @@ static int igb_mii_ioctl(struct net_device *netdev, struct ifreq *ifr, int cmd)
>>>   			return -EIO;
>>>   		break;
>>>   	case SIOCSMIIREG:
>>> +		adapter->hw.phy.addr = data->phy_id;
>>> +		if (igb_write_phy_reg(&adapter->hw, data->reg_num & 0x1F,
>>> +				      data->val_in))
>>> +			return -EIO;
>>> +		break;
>>>   	default:
>>>   		return -EOPNOTSUPP;
>>>   	}
>>
>> How and why is this being used?  From what I can tell it looks like it is an easy way to break any of the existing interfaces if it is misused since all you would need to do is specify a phy address that doesn't match the existing PHY in the system and then you would likely lose link, or possibly mess up the configuration on the system requiring.
>>
>> I suspect this is a back door for some piece of user space code that is being given far more permission than it should be.
>
> I don't know about a back door, but the real problem is that it has a
> side-effect of changing the saved value of the phy addr. That is clearly
> a problem and can't be allowed.

This patch was worse before... it had changes in SIOGMIIREG that had 
similar side-effects, missed this one.

Checking with some of the platform people here this patch can be 
dropped. We don't use it as a backdoor of any kind it was mainly used 
for debugging/guess-what-the-phy-addr-was when we originally got the boards.
>
> For the phylib stuff to really work as intended, the igb_write_phy_reg
> really should take the phy address as a parameter instead of getting
> the value from the structure itself. Or a new function should be
> defined that has that interface.
>
> --
> Mark Rustad, Networking Division, Intel Corporation
>

  reply	other threads:[~2015-05-08 16:57 UTC|newest]

Thread overview: 36+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2015-04-17 20:23 [Intel-wired-lan] [PATCH v1 net-next 1/2] igb: add PHY support for Broadcom 5461S Jonathan Toppins
2015-04-17 20:23 ` Jonathan Toppins
2015-04-17 20:24 ` [Intel-wired-lan] [PATCH v1 net-next 2/2] igb: support SIOCSMIIREG Jonathan Toppins
2015-04-17 20:24   ` Jonathan Toppins
2015-05-05 17:25   ` [Intel-wired-lan] " Brown, Aaron F
2015-05-05 17:25     ` Brown, Aaron F
2015-05-05 19:31     ` [Intel-wired-lan] " Jonathan Toppins
2015-05-05 19:31       ` Jonathan Toppins
2015-05-07 17:52   ` [Intel-wired-lan] " Alexander Duyck
2015-05-07 17:52     ` Alexander Duyck
2015-05-07 20:46     ` [Intel-wired-lan] " Rustad, Mark D
2015-05-07 20:46       ` Rustad, Mark D
2015-05-08 16:57       ` Jonathan Toppins [this message]
2015-05-08 16:57         ` Jonathan Toppins
2015-04-27 15:44 ` [Intel-wired-lan] [PATCH v1 net-next 1/2] igb: add PHY support for Broadcom 5461S Jonathan Toppins
2015-04-27 15:44   ` Jonathan Toppins
2015-05-02  1:45   ` [Intel-wired-lan] " Brown, Aaron F
2015-05-02  1:45     ` Brown, Aaron F
2015-05-07 11:49 ` [Intel-wired-lan] " Jeff Kirsher
2015-05-07 13:41   ` Andy Gospodarek
2015-05-07 17:49     ` Alexander Duyck
2015-05-08 16:39     ` Ronciak, John
2015-05-08 17:46       ` Andy Gospodarek
2015-05-08 21:32         ` Alexander Duyck
2015-05-08 21:42           ` Jonathan Toppins
2015-05-08 22:05             ` Alexander Duyck
2015-05-08 22:30               ` Jonathan Toppins
2015-05-08 23:06                 ` Alexander Duyck
2015-05-11 14:46           ` Andy Gospodarek
2015-05-07 16:32   ` Tim Harvey
2015-05-07 16:18 ` Tim Harvey
2015-05-07 16:18   ` Tim Harvey
2015-05-07 16:57   ` [Intel-wired-lan] " Jonathan Toppins
2015-05-07 16:57     ` Jonathan Toppins
2015-05-07 18:20 ` [Intel-wired-lan] " Alexander Duyck
2015-05-07 18:20   ` Alexander Duyck

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=554CEB0C.40308@cumulusnetworks.com \
    --to=jtoppins@cumulusnetworks.com \
    --cc=intel-wired-lan@osuosl.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.