From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from smtp3.osuosl.org (smtp3.osuosl.org [140.211.166.136]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id E8BF7EBFD30 for ; Mon, 13 Apr 2026 10:30:59 +0000 (UTC) Received: from localhost (localhost [127.0.0.1]) by smtp3.osuosl.org (Postfix) with ESMTP id A021D60B09; Mon, 13 Apr 2026 10:30:59 +0000 (UTC) X-Virus-Scanned: amavis at osuosl.org Received: from smtp3.osuosl.org ([127.0.0.1]) by localhost (smtp3.osuosl.org [127.0.0.1]) (amavis, port 10024) with ESMTP id Bj0tXB9H5r-I; Mon, 13 Apr 2026 10:30:59 +0000 (UTC) X-Comment: SPF check N/A for local connections - client-ip=140.211.166.142; helo=lists1.osuosl.org; envelope-from=intel-wired-lan-bounces@osuosl.org; receiver= DKIM-Filter: OpenDKIM Filter v2.11.0 smtp3.osuosl.org 15BC860BC6 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=osuosl.org; s=default; t=1776076259; bh=sUUF+72eSb9zEIZzvMPZr0bN9WaFPdpDxmbWRONnTUA=; h=Date:From:To:Cc:References:In-Reply-To:Subject:List-Id: List-Unsubscribe:List-Archive:List-Post:List-Help:List-Subscribe: From; b=97xs6mSHeqJVYOK8Ypmpeir2jNbY8QTqv0RDq1Ty9iLWb8x6S0UtChLxz4+cjE4ao Czlta7ilSHEQwMuGebmr6uPhbO88yWvci+vzoQH/mJlEXaC+9CIoKHMSMSaTxdwvIZ meaa6ew4cbZm/bJekBx8OAeP74Y0mZtX3Z4CuDDElyyEcivW0/vkhAvxQj9dNdWpD3 LEVxMJ8E8sYybVY/0eyePN7aXnmDR3G6tI9m5pbQaboxP+IzxxOrAUxO1+Trege2Ix endwE4o3M6jz4xnOyVyPRVBuAy6DikhFTFJ8qfb2aIuMaIbLjOKwDDRlDIDpENu388 AFxIMowI4u+Bg== Received: from lists1.osuosl.org (lists1.osuosl.org [140.211.166.142]) by smtp3.osuosl.org (Postfix) with ESMTP id 15BC860BC6; Mon, 13 Apr 2026 10:30:59 +0000 (UTC) Received: from smtp3.osuosl.org (smtp3.osuosl.org [140.211.166.136]) by lists1.osuosl.org (Postfix) with ESMTP id 80242283 for ; Mon, 13 Apr 2026 10:30:57 +0000 (UTC) Received: from localhost (localhost [127.0.0.1]) by smtp3.osuosl.org (Postfix) with ESMTP id 65A9C60BC6 for ; Mon, 13 Apr 2026 10:30:57 +0000 (UTC) X-Virus-Scanned: amavis at osuosl.org Received: from smtp3.osuosl.org ([127.0.0.1]) by localhost (smtp3.osuosl.org [127.0.0.1]) (amavis, port 10024) with ESMTP id wxXpVkI_m3ou for ; Mon, 13 Apr 2026 10:30:56 +0000 (UTC) Received-SPF: Pass (mailfrom) identity=mailfrom; client-ip=172.105.4.254; helo=tor.source.kernel.org; envelope-from=horms@kernel.org; receiver= DMARC-Filter: OpenDMARC Filter v1.4.2 smtp3.osuosl.org 8E05D60B09 DKIM-Filter: OpenDKIM Filter v2.11.0 smtp3.osuosl.org 8E05D60B09 Received: from tor.source.kernel.org (tor.source.kernel.org [172.105.4.254]) by smtp3.osuosl.org (Postfix) with ESMTPS id 8E05D60B09 for ; Mon, 13 Apr 2026 10:30:56 +0000 (UTC) Received: from smtp.kernel.org (transwarp.subspace.kernel.org [100.75.92.58]) by tor.source.kernel.org (Postfix) with ESMTP id EC8DD60180; Mon, 13 Apr 2026 10:30:54 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 845FFC2BCB5; Mon, 13 Apr 2026 10:30:53 +0000 (UTC) Date: Mon, 13 Apr 2026 11:30:50 +0100 From: Simon Horman To: Aleksandr Loktionov Cc: intel-wired-lan@lists.osuosl.org, anthony.l.nguyen@intel.com, netdev@vger.kernel.org, Paul Greenwalt Message-ID: <20260413103050.GL469338@kernel.org> References: <20260408131154.2661818-1-aleksandr.loktionov@intel.com> <20260408131154.2661818-3-aleksandr.loktionov@intel.com> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <20260408131154.2661818-3-aleksandr.loktionov@intel.com> X-Mailman-Original-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1776076254; bh=ZZ5n5swHim3raXBjfjDTGvGtf3AkWA9HWolWBpnbGSI=; h=Date:From:To:Cc:Subject:References:In-Reply-To:From; b=hi3v3CtyoEcPmYpmhDY4nfGSXYwTU80Qf8lFCGEC3mLRH9b6GWU38gKyBkhg6kqpx nGG0Dh+HoSB0FMn5SJR7dCmunvpBQneZ5bS4Vxk9NBGBsoH3T2mFnf3BuTHlKSk4j3 C7WW3FToIAqDCGUawKdHmhZfEmwcBzJyAcPtoaWi9/5nUPdlSPtbpZM0Y7+eSTU5q7 xcJUmGfzl6JSJVUMW4VWkaRqRGmkvpa556FTsUewU7VKH6UsVHvzXBFsf3+basZN8+ p5FdC4hUxoR8MJISV/kJsxKOh7fnKqyvwqYVmlV/fHLhUoEJgrshLwF9ZMBYBhunCz 9A2+7wgktv5GA== X-Mailman-Original-Authentication-Results: smtp3.osuosl.org; dmarc=pass (p=quarantine dis=none) header.from=kernel.org X-Mailman-Original-Authentication-Results: smtp3.osuosl.org; dkim=pass (2048-bit key, unprotected) header.d=kernel.org header.i=@kernel.org header.a=rsa-sha256 header.s=k20201202 header.b=hi3v3Cty Subject: Re: [Intel-wired-lan] [PATCH iwl-net v2 2/6] ixgbe: add bounds check for debugfs register access X-BeenThere: intel-wired-lan@osuosl.org X-Mailman-Version: 2.1.30 Precedence: list List-Id: Intel Wired Ethernet Linux Kernel Driver Development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: intel-wired-lan-bounces@osuosl.org Sender: "Intel-wired-lan" On Wed, Apr 08, 2026 at 03:11:50PM +0200, Aleksandr Loktionov wrote: > From: Paul Greenwalt > > Prevent out-of-bounds MMIO accesses triggered through user-controlled > register offsets. IXGBE_HFDR (0x15FE8) is the highest valid MMIO > register in the ixgbe register map; any offset beyond it would address > unmapped memory. > > Add a defense-in-depth check at two levels: > > 1. ixgbe_read_reg() -- the noinline register read accessor. A > WARN_ON_ONCE() guard here catches any future code path (including > ioctl extensions) that might inadvertently pass an out-of-range > offset without relying on higher layers to catch it first. > ixgbe_write_reg() is a static inline called from the TX/RX hot path; > adding WARN_ON_ONCE there would inline the check at every call site, > so only the read path gets this guard. > > 2. ixgbe_dbg_reg_ops_write() -- the debugfs 'reg_ops' interface is the > only current path where a raw, user-supplied offset enters the driver. > Gating it before invoking the register accessors provides a clean, > user-visible failure (silent ignore with no kernel splat) for > deliberately malformed debugfs writes. > > Add a reg <= IXGBE_HFDR guard to both the read and write paths in > ixgbe_dbg_reg_ops_write(), and a WARN_ON_ONCE + early-return guard to > ixgbe_read_reg(). > > Fixes: 91fbd8f081e2 ("ixgbe: added reg_ops file to debugfs") > Signed-off-by: Paul Greenwalt > Cc: stable@vger.kernel.org > Signed-off-by: Aleksandr Loktionov > --- > v1 -> v2: > - Add Fixes: tag; reroute from iwl-next to iwl-net (security-relevant > hardening for user-controllable out-of-bounds MMIO). Thanks for the update. And sorry for not thinking to ask this earlier: this patch addresses possible overruns of the mapped address space if the supplied value for reg is too large. But do we also need a guard against underrun if the value for reg is too small? ...