From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-qv1-f44.google.com (mail-qv1-f44.google.com [209.85.219.44]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id D91C841DECE for ; Mon, 6 Jul 2026 15:54:16 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.219.44 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1783353259; cv=none; b=QNlaoddGxv8C188bKw5OHahhRgdbRTeSrfnxGRXWhKYnxl+WMmM289rt0fiKe0LCtKoBfcnYAJucAgk7QEjw4vu7y98qfeHLeg6XSEEMjarduwXzSzE6WqtFKRgMHxCx74+rZ8hJytumgqpkNk8CJddcXJwgFd7v0rDeLI2i74g= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1783353259; c=relaxed/simple; bh=jgtOj6HV0Lc74Fqi3YIUHikZwpNHEx6Z+PICt2TBtOc=; h=Date:From:To:Cc:Subject:Message-ID:References:MIME-Version: Content-Type:Content-Disposition:In-Reply-To; b=LBiygJ/bluXy6BMHXAzA5+D5pXNOu4Nu3sk6ONja/GhWowXLAsSTNsOwIb2J/92QgoIBO0AOK4xUTX9sLvhHwZHb78jhe4mZUkqEGc6RtqmPkohJTtPkeb+OcAFKhDdG7Zlf2zVzA7xK/eN9qMoEtdnt0OSonMm3nePOD/Ee15w= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=ziepe.ca; spf=pass smtp.mailfrom=ziepe.ca; dkim=pass (2048-bit key) header.d=ziepe.ca header.i=@ziepe.ca header.b=T/8O1Qpe; arc=none smtp.client-ip=209.85.219.44 Authentication-Results: smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=ziepe.ca Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=ziepe.ca Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=ziepe.ca header.i=@ziepe.ca header.b="T/8O1Qpe" Received: by mail-qv1-f44.google.com with SMTP id 6a1803df08f44-8eff5ce3b95so23676856d6.3 for ; Mon, 06 Jul 2026 08:54:16 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ziepe.ca; s=google; t=1783353256; x=1783958056; darn=vger.kernel.org; h=in-reply-to:content-disposition:content-type:mime-version :references:message-id:subject:cc:to:from:date:from:to:cc:subject :date:message-id:reply-to:content-type; bh=dIem8hyNlrcvgSP8xqIijowENEp+G1sYVnPl46s39CA=; b=T/8O1QpeP78nJ/OkqbzrxdaIXjUVtpEka/Sb8ndpjaSMdimAv/kSDNox7FixBtsj9h YqJgFxZuZb/ykoTmKJ3ESaihh/hGQtw+zFEY79mwmbAfCnEf2PR+d5NHpXvK6fG30as7 j11EnI+E0XeeuSC4Z0GBFGBu3x/6ll/xUhtfvkCc51fjrZRZWiqNDCtqbnCYkqfXQWf7 ldLZtSRidM3DrBYVoLrYwuthnwf9KzYeshNCDQmRjABVbYjOMZrOLnHlww8SZd+Ah+Jv WJ2zcIKWdAuWlB/ilMZKeqjz2/TPRFfA7bY3H5i5ZBKL18gKoExPaAzw1O51dhhGlqBX Hgzw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1783353256; x=1783958056; h=in-reply-to:content-disposition:content-type:mime-version :references:message-id:subject:cc:to:from:date:x-gm-gg :x-gm-message-state:from:to:cc:subject:date:message-id:reply-to :content-type; bh=dIem8hyNlrcvgSP8xqIijowENEp+G1sYVnPl46s39CA=; b=GzCOgu7qwqDtdkawYBtJLjcNqHv6IuTypSyz4+DwUbEpDn8evlfzvsxLgkfymnNDmC bUlSEz91EW/I+1SJxyVlVNiwpvunTmdQTWxr4IRMu3lPm9DN00NGJ4kuZcpO63AkKgGG C4yb4w+CMeGq4F19MXWmlnoZZcRs5B59pk87kWeV8ZdVCziiH5ADXAPMEn1KyxsUN9VD eBP5jVk8R/Eyt+q2X8Zvx456Rh51gOVAwvgOMZ2vY8U/1blV6OE0UXY+CQBEuDBrgd1x uhZfcVYNNvROdpPabS1b9CWSj1ex6Uy5mTgPPT1hugbhVRZo69Wr73bGjvBPNN/MzFjx lBCQ== X-Forwarded-Encrypted: i=1; AHgh+RqSen/SZXYlYFHC0EXHlSr/mhjFuvnc6ljqsQ8H9BOv+hR5W10j4ccAkznHYhMdqNRs/ebKa4eEdbYfddw=@vger.kernel.org X-Gm-Message-State: AOJu0Ywl8JiQdgbyuFimrBYHtz6hyUHqvgng6je2TM58Rl30d4WqnuZx pf6IV0b/GkdvTJiogiviCQF9TKW0q+Lyctwqi1qddB/iJ85BPxAzDpU2R0maKBx9MYE= X-Gm-Gg: AfdE7cn5xv8XJ+cECsNRTYhN/ayjHHXsuRitwdlgE5n3Tp25qEj1JqvsWKhycrLJ7uv 3PFx3qVDi9gnB4LZYCp7spj9HFYj56rLAMSSLO96TAciWEw1jpXa/4CuSDhLg5sZLT/MWpRmb7j Ja2cjC3lhb6T7BX26LxudI7JwKnY23+hTEgXfnIrBdB8V/JdQuxeB6h1bpKHuD4ZkXpgw1I6/M3 ioRi5GZMMz3xnUAtCIC2cLlmGhPHAlJ989bFeuRAsGsx+s3ngoROb3gf2tfiiRLt6bupDUSz+9E /pyJZCXjYdFTyKGGRcjifumlu2gSCVZBS+9VnWmCqCUJZoFDLX0u1a8NJMmxPr7uR9Qd/VS3Kx5 ZuBXy+SQJZu7dokg/TP637PT/LKCUwRw9hGGhpRpv1JiU6iiJnEFpCqIHceuB X-Received: by 2002:a05:6214:4506:b0:8ef:4749:b1cd with SMTP id 6a1803df08f44-8fcb461b5cdmr13721496d6.30.1783353255815; Mon, 06 Jul 2026 08:54:15 -0700 (PDT) Received: from ziepe.ca ([159.2.72.92]) by smtp.gmail.com with ESMTPSA id 6a1803df08f44-8f4724bad04sm151773616d6.44.2026.07.06.08.54.15 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 06 Jul 2026 08:54:15 -0700 (PDT) Received: from jgg by wakko with local (Exim 4.97) (envelope-from ) id 1wgleA-00000000a9W-2CyF; Mon, 06 Jul 2026 12:54:14 -0300 Date: Mon, 6 Jul 2026 12:54:14 -0300 From: Jason Gunthorpe To: Zhenhao Wan , Dan Williams Cc: Davidlohr Bueso , Jonathan Cameron , Dave Jiang , Alison Schofield , Vishal Verma , Ira Weiny , Li Ming , linux-cxl@vger.kernel.org, linux-kernel@vger.kernel.org, Yuhao Jiang Subject: Re: [PATCH] cxl/features: bound fwctl command payload to the input buffer Message-ID: <20260706155414.GA118978@ziepe.ca> References: <20260620-cxl-fwctl-oob-v1-1-5758e34d784a@gmail.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <20260620-cxl-fwctl-oob-v1-1-5758e34d784a@gmail.com> On Sat, Jun 20, 2026 at 12:33:15PM +0800, Zhenhao Wan wrote: > fwctl_cmd_rpc() copies cmd->in_len bytes into inbuf = kvzalloc(cmd->in_len) > and passes inbuf and in_len to ->fw_rpc(). The CXL callback cxlctl_fw_rpc() > ignores in_len and never checks the user-controlled op_size against it. > > cxlctl_set_feature() bounds op_size only from below > (op_size <= sizeof(feat_in->hdr)) and then reads op_size - sizeof(hdr) > bytes from feat_in->feat_data via cxl_set_feature(). With a small in_len > and a large op_size the first memcpy() already reads past the > kvzalloc(in_len) buffer; the out-of-bounds bytes are placed in the mailbox > payload and sent to the device, and a large enough op_size can walk into > unmapped memory and oops the kernel. The Get paths pin op_size to a fixed > size but likewise read the input struct without checking in_len. > > Reject, at the single dispatch point, any request whose fixed header plus > op_size does not fit in the copied-in buffer. The lower-bound test guards > the subtraction and ensures op_size was copied in before it is read. > > Fixes: eb5dfcb9e36d ("cxl: Add support to handle user feature commands for set feature") > Reported-by: Yuhao Jiang > Signed-off-by: Zhenhao Wan > --- > drivers/cxl/core/features.c | 8 +++++++- > 1 file changed, 7 insertions(+), 1 deletion(-) Reviewed-by: Jason Gunthorpe CXL folks, you will pick this up? I think it should be cc stable too Jason