Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18;
To:     davem@davemloft.net, gregkh@linuxfoundation.org, kuba@kernel.org,
        christophe.jaillet@wanadoo.fr, leon@kernel.org, tglx@linutronix.de
Cc:     netdev@vger.kernel.org, linux-kernel@vger.kernel.org
From:   Jia-Ju Bai <baijiaju1990@gmail.com>
Subject: [BUG] net: chelsio: Possible buffer overflow caused by DMA
 failures/attacks
Message-ID: <95e19362-b9c9-faf9-3f9e-f6f4c65a6aff@gmail.com>
Date:   Tue, 5 May 2020 23:50:28 +0800
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:68.0) Gecko/20100101
 Thunderbird/68.4.1
MIME-Version: 1.0
Content-Type: text/plain; charset=utf-8; format=flowed
Content-Transfer-Encoding: 8bit
Content-Language: en-US
Sender: linux-kernel-owner@vger.kernel.org
Precedence: bulk

In alloc_rx_resources():
     sge->respQ.entries =
         pci_alloc_consistent(pdev, size, &sge->respQ.dma_addr);

Thus, "sge->respQ.entries" is a DMA value, and it is assigned to
"e" in process_pure_responses():
     struct sge *sge = adapter->sge;
     struct respQ *q = &sge->respQ;
     struct respQ_e *e = &q->entries[q->cidx];

When DMA failures or attacks occur, the data stored in "e" can be
changed at any time. In this case, the value of "e->FreelistQid"
can be a large number to cause buffer overflow when the
following code is executed:
     const struct freelQ *fl = &sge->freelQ[e->FreelistQid];

Similarly, "sge->respQ.entries" is also assigned to "e" in
process_responses():
     struct sge *sge = adapter->sge;
     struct respQ *q = &sge->respQ;
     struct respQ_e *e = &q->entries[q->cidx];

When DMA failures or attacks occur, the data stored in "e" can be
changed at any time. In this case, the value of "e->FreelistQid"
can be a large number to cause buffer overflow when the
following code is executed:
     struct freelQ *fl = &sge->freelQ[e->FreelistQid];

Considering that DMA can fail or be attacked, I think that it is 
dangerous to
use a DMA value (or any value tainted by it) as an array index or a 
control-flow
condition. However, I have found many such dangerous cases in Linux 
device drivers
through my static-analysis tool and code review.
I am not sure whether my opinion is correct, so I want to listen to your 
points of view.
Thanks in advance :)


Best wishes,
Jia-Ju Bai