Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67;
From:   Jonathan Toppins <jtoppins@redhat.com>
To:     netdev@vger.kernel.org
Cc:     Ariel Elior <aelior@marvell.com>,
        Sudarsana Kalluru <skalluru@marvell.com>,
        GR-everest-linux-l2@marvell.com,
        "David S. Miller" <davem@davemloft.net>,
        linux-kernel@vger.kernel.org
Subject: [PATCH net-next] bnx2x: initialize ethtool info->fw_version before use
Date:   Mon, 18 Nov 2019 12:07:53 -0500
Message-Id: <f40bcf8cd93677c12bca1f06e74385c9a5f49819.1574096873.git.jtoppins@redhat.com>
Content-Type: text/plain; charset=WINDOWS-1252
Content-Transfer-Encoding: quoted-printable
Sender: linux-kernel-owner@vger.kernel.org
Precedence: bulk

If the info->fw_version has garbage in the buffer this can lead to a BUG()
being generated in strlcat() due to the use of strlen(). Initialize the
buffer before use.

The use of a systemtap script can demonstrate the problem by injecting
garbage into fw_version:

    [root@localhost ~]# cat net-info.stp
    //
    // compile and run with command
    //# stap -g   net-info.stp
    //
    probe begin { printf("net-info  version 01.01\n")}

    function memset(msg:long) %{
    =09memset((char*)STAP_ARG_msg,-1,196);
    %}

    probe module("bnx2x").function("bnx2x_get_drvinfo")
    {
      printf("In function\n");
      memset(register("rsi"));
    }

    [root@localhost ~]# stap -g net-info.stp &
    net-info  version 01.01
    [root@localhost ~]# ethtool -i eth1

Signed-off-by: Jonathan Toppins <jtoppins@redhat.com>
---
 drivers/net/ethernet/broadcom/bnx2x/bnx2x_ethtool.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_ethtool.c b/drivers/=
net/ethernet/broadcom/bnx2x/bnx2x_ethtool.c
index 4a0ba6801c9e..49b906396dcf 100644
--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_ethtool.c
+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_ethtool.c
@@ -1111,6 +1111,8 @@ static void bnx2x_get_drvinfo(struct net_device *dev,
 =09int ext_dev_info_offset;
 =09u32 mbi;
=20
+=09info->fw_version[0] =3D 0;
+
 =09strlcpy(info->driver, DRV_MODULE_NAME, sizeof(info->driver));
 =09strlcpy(info->version, DRV_MODULE_VERSION, sizeof(info->version));
=20
--=20
2.16.4