[PATCH v2] net: ethernet: dec: tulip: de4x5: fix possible array overflows in type3_infoblock()

[PATCH v2] net: ethernet: dec: tulip: de4x5: fix possible array overflows in type3_infoblock()

[Teng Qi]

The definition of macro MOTO_SROM_BUG is:
  #define MOTO_SROM_BUG    (lp->active == 8 && (get_unaligned_le32(
  dev->dev_addr) & 0x00ffffff) == 0x3e0008)

and the if statement
  if (MOTO_SROM_BUG) lp->active = 0;

using this macro indicates lp->active could be 8. If lp->active is 8 and
the second comparison of this macro is false. lp->active will remain 8 in:
  lp->phy[lp->active].gep = (*p ? p : NULL); p += (2 * (*p) + 1);
  lp->phy[lp->active].rst = (*p ? p : NULL); p += (2 * (*p) + 1);
  lp->phy[lp->active].mc  = get_unaligned_le16(p); p += 2;
  lp->phy[lp->active].ana = get_unaligned_le16(p); p += 2;
  lp->phy[lp->active].fdx = get_unaligned_le16(p); p += 2;
  lp->phy[lp->active].ttm = get_unaligned_le16(p); p += 2;
  lp->phy[lp->active].mci = *p;

However, the length of array lp->phy is 8, so array overflows can occur.
To fix these possible array overflows, we first check lp->active and then
return -EINVAL if it is greater or equal to ARRAY_SIZE(lp->phy) (i.e. 8).

Reported-by: TOTE Robot <oslab@tsinghua.edu.cn>
Signed-off-by: Teng Qi <starmiku1207184332@gmail.com>
---
v2:
* Check lp->active in separate if statement within macro WARN_ON() and 
return -EINVAL if it is greater or equal to ARRAY_SIZE(lp->phy). Instead
of checking lp->active and MOTO_SROM_BUG together in the same if
statement.
  Thank Arnd Bergmann for helpful and friendly suggestion.
---
 drivers/net/ethernet/dec/tulip/de4x5.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/drivers/net/ethernet/dec/tulip/de4x5.c b/drivers/net/ethernet/dec/tulip/de4x5.c
index 13121c4dcfe6..828b9642fd68 100644
--- a/drivers/net/ethernet/dec/tulip/de4x5.c
+++ b/drivers/net/ethernet/dec/tulip/de4x5.c
@@ -4709,6 +4709,10 @@ type3_infoblock(struct net_device *dev, u_char count, u_char *p)
         lp->ibn = 3;
         lp->active = *p++;
 	if (MOTO_SROM_BUG) lp->active = 0;
+	/* if (MOTO_SROM_BUG) statement indicates lp->active could
+	 * be 8 (i.e. the size of array lp->phy) */
+	if (WARN_ON(lp->active >= ARRAY_SIZE(lp->phy)))
+		return -EINVAL;
 	lp->phy[lp->active].gep = (*p ? p : NULL); p += (2 * (*p) + 1);
 	lp->phy[lp->active].rst = (*p ? p : NULL); p += (2 * (*p) + 1);
 	lp->phy[lp->active].mc  = get_unaligned_le16(p); p += 2;
-- 
2.25.1

Re: [PATCH v2] net: ethernet: dec: tulip: de4x5: fix possible array overflows in type3_infoblock()

[Arnd Bergmann]

On Thu, Nov 18, 2021 at 8:01 AM Teng Qi <starmiku1207184332@gmail.com> wrote:
>
> The definition of macro MOTO_SROM_BUG is:
>   #define MOTO_SROM_BUG    (lp->active == 8 && (get_unaligned_le32(
>   dev->dev_addr) & 0x00ffffff) == 0x3e0008)
>
> and the if statement
>   if (MOTO_SROM_BUG) lp->active = 0;
>
> using this macro indicates lp->active could be 8. If lp->active is 8 and
> the second comparison of this macro is false. lp->active will remain 8 in:
>   lp->phy[lp->active].gep = (*p ? p : NULL); p += (2 * (*p) + 1);
>   lp->phy[lp->active].rst = (*p ? p : NULL); p += (2 * (*p) + 1);
>   lp->phy[lp->active].mc  = get_unaligned_le16(p); p += 2;
>   lp->phy[lp->active].ana = get_unaligned_le16(p); p += 2;
>   lp->phy[lp->active].fdx = get_unaligned_le16(p); p += 2;
>   lp->phy[lp->active].ttm = get_unaligned_le16(p); p += 2;
>   lp->phy[lp->active].mci = *p;
>
> However, the length of array lp->phy is 8, so array overflows can occur.
> To fix these possible array overflows, we first check lp->active and then
> return -EINVAL if it is greater or equal to ARRAY_SIZE(lp->phy) (i.e. 8).
>
> Reported-by: TOTE Robot <oslab@tsinghua.edu.cn>
> Signed-off-by: Teng Qi <starmiku1207184332@gmail.com>

Reviewed-by: Arnd Bergmann <arnd@arndb.de>

Re: [PATCH v2] net: ethernet: dec: tulip: de4x5: fix possible array overflows in type3_infoblock()

[patchwork-bot+netdevbpf]

Hello:

This patch was applied to netdev/net.git (master)
by David S. Miller <davem@davemloft.net>:

On Thu, 18 Nov 2021 15:01:18 +0800 you wrote:
> The definition of macro MOTO_SROM_BUG is:
>   #define MOTO_SROM_BUG    (lp->active == 8 && (get_unaligned_le32(
>   dev->dev_addr) & 0x00ffffff) == 0x3e0008)
> 
> and the if statement
>   if (MOTO_SROM_BUG) lp->active = 0;
> 
> [...]

Here is the summary with links:
  - [v2] net: ethernet: dec: tulip: de4x5: fix possible array overflows in type3_infoblock()
    https://git.kernel.org/netdev/net/c/0fa68da72c3b

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html