Received: by 2002:ac0:e34a:0:0:0:0:0 with SMTP id g10csp483114imn; Wed, 27 Jul 2022 11:27:35 -0700 (PDT) X-Google-Smtp-Source: AGRyM1sHzbY09OpOgRiQVCkIMXeFQ/FDzD4uBs6ThoRZiN6uuYS4eD2d7fO+66pASOKfDVl+mB6c X-Received: by 2002:a17:907:9495:b0:72f:a158:7598 with SMTP id dm21-20020a170907949500b0072fa1587598mr17637545ejc.410.1658946454853; Wed, 27 Jul 2022 11:27:34 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1658946454; cv=none; d=google.com; s=arc-20160816; b=gwg/p5UIhl3Lk1w/qEgYxPao/p5PIXcruEHeuyRz5q5BV2t/PrBTPWZyn6Psv+Srvl TPSSFHj6smwCf2rwft6LEtclhEM+KOiXNjZoYioZYpvKsZvGxdO+rXAC0D+yvRYMkt+e 6I0ekBo0BibAyc7gOsMD8sd2qQFcw1iw3orY6rk/ltitW2caa9HYGasZAGfAR6FgUraS Y+8DS87JCMRuvar3gDnuoL/gIhuAw9fmQhfN1ovntv/lEf1gj9LBUGEtRm6kPEAGfQcG G/N59xgkzKxI64w06c168nqfDe60tJciXyLvIon8ETdIJg5mIyyy1mJbZ3qpYzckCiBb 2Scg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:content-transfer-encoding:mime-version :user-agent:references:in-reply-to:message-id:date:subject:cc:to :from:dkim-signature; bh=LaT4voqMr0RUO1NgVGCMtyEKvO5KuT3V1YrkRLLjJE4=; b=vh9M7184VipmLvP+zG35rFgq7WY1u/ekGmfhQR3qXOwuKaa1KqMRAR0e/+s2n9Nj8a Sq3ESs7QAkZdo0gHFb2MsLZQy1ckGGRHp4/pQy9g8UVx7W4UNL2ujUaSJQmNrX6WGz5t 0q28CQ7Nw4qM0o+LnJHU3M6c2Vb/PuHnxuv4RoMMUtGXduttxvkDbhTrwaD2LA7rkEnK sD1PWRDFOdhk+UHYPPRW5rt9gaqE8hqR/Um1RsX9ynasBlkZfPfkC36z25GCHtjGGhpd uAgdIlIIL8PfJ8wP8WheDQO6azZUA3CFSZYvvriBNUBEmT6iTdl3ymp4aX856EyS98DT ucuQ== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@linuxfoundation.org header.s=korg header.b=Om9LuwHi; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linuxfoundation.org Return-Path: Received: from out1.vger.email (out1.vger.email. [2620:137:e000::1:20]) by mx.google.com with ESMTP id d32-20020a056402402000b0043cdab5f1a4si237677eda.350.2022.07.27.11.27.03; Wed, 27 Jul 2022 11:27:34 -0700 (PDT) Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20; Authentication-Results: mx.google.com; dkim=pass header.i=@linuxfoundation.org header.s=korg header.b=Om9LuwHi; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linuxfoundation.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S235081AbiG0QW2 (ORCPT + 99 others); Wed, 27 Jul 2022 12:22:28 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:49066 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S234962AbiG0QWF (ORCPT ); Wed, 27 Jul 2022 12:22:05 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [139.178.84.217]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 5C7CC4B0DD; Wed, 27 Jul 2022 09:22:04 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id EC85761995; Wed, 27 Jul 2022 16:22:03 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 090EDC433C1; Wed, 27 Jul 2022 16:22:02 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1658938923; bh=WOj+s5vKPdoTepok1yhOUhX1S4XBseNZDgBPvkKvjHk=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=Om9LuwHireBxHycKymkBrJ7pQt8ov8KZX8FR8OPw4n8GnylUhZ1Y4A3O4OaMKGpm4 uivkhJ5UmwcNvC7LzAc6vccwJ48y2rhoS6bnGKSXGP4JaZDZ6EYc4A8KBrvJ9cemul wU07Kqw00zRIKMsiOsQAh4tgR575Y7zjrwpPkv/M= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Hristo Venev , Paolo Abeni , Sasha Levin Subject: [PATCH 4.9 16/26] be2net: Fix buffer overflow in be_get_module_eeprom Date: Wed, 27 Jul 2022 18:10:45 +0200 Message-Id: <20220727160959.770313545@linuxfoundation.org> X-Mailer: git-send-email 2.37.1 In-Reply-To: <20220727160959.122591422@linuxfoundation.org> References: <20220727160959.122591422@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit X-Spam-Status: No, score=-7.7 required=5.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,RCVD_IN_DNSWL_HI, SPF_HELO_NONE,SPF_PASS autolearn=ham autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on lindbergh.monkeyblade.net Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: Hristo Venev [ Upstream commit d7241f679a59cfe27f92cb5c6272cb429fb1f7ec ] be_cmd_read_port_transceiver_data assumes that it is given a buffer that is at least PAGE_DATA_LEN long, or twice that if the module supports SFF 8472. However, this is not always the case. Fix this by passing the desired offset and length to be_cmd_read_port_transceiver_data so that we only copy the bytes once. Fixes: e36edd9d26cf ("be2net: add ethtool "-m" option support") Signed-off-by: Hristo Venev Link: https://lore.kernel.org/r/20220716085134.6095-1-hristo@venev.name Signed-off-by: Paolo Abeni Signed-off-by: Sasha Levin --- drivers/net/ethernet/emulex/benet/be_cmds.c | 10 +++--- drivers/net/ethernet/emulex/benet/be_cmds.h | 2 +- .../net/ethernet/emulex/benet/be_ethtool.c | 31 ++++++++++++------- 3 files changed, 25 insertions(+), 18 deletions(-) diff --git a/drivers/net/ethernet/emulex/benet/be_cmds.c b/drivers/net/ethernet/emulex/benet/be_cmds.c index 8887dd3abed7..619cc13ffb55 100644 --- a/drivers/net/ethernet/emulex/benet/be_cmds.c +++ b/drivers/net/ethernet/emulex/benet/be_cmds.c @@ -2291,7 +2291,7 @@ int be_cmd_get_beacon_state(struct be_adapter *adapter, u8 port_num, u32 *state) /* Uses sync mcc */ int be_cmd_read_port_transceiver_data(struct be_adapter *adapter, - u8 page_num, u8 *data) + u8 page_num, u32 off, u32 len, u8 *data) { struct be_dma_mem cmd; struct be_mcc_wrb *wrb; @@ -2325,10 +2325,10 @@ int be_cmd_read_port_transceiver_data(struct be_adapter *adapter, req->port = cpu_to_le32(adapter->hba_port_num); req->page_num = cpu_to_le32(page_num); status = be_mcc_notify_wait(adapter); - if (!status) { + if (!status && len > 0) { struct be_cmd_resp_port_type *resp = cmd.va; - memcpy(data, resp->page_data, PAGE_DATA_LEN); + memcpy(data, resp->page_data + off, len); } err: mutex_unlock(&adapter->mcc_lock); @@ -2419,7 +2419,7 @@ int be_cmd_query_cable_type(struct be_adapter *adapter) int status; status = be_cmd_read_port_transceiver_data(adapter, TR_PAGE_A0, - page_data); + 0, PAGE_DATA_LEN, page_data); if (!status) { switch (adapter->phy.interface_type) { case PHY_TYPE_QSFP: @@ -2444,7 +2444,7 @@ int be_cmd_query_sfp_info(struct be_adapter *adapter) int status; status = be_cmd_read_port_transceiver_data(adapter, TR_PAGE_A0, - page_data); + 0, PAGE_DATA_LEN, page_data); if (!status) { strlcpy(adapter->phy.vendor_name, page_data + SFP_VENDOR_NAME_OFFSET, SFP_VENDOR_NAME_LEN - 1); diff --git a/drivers/net/ethernet/emulex/benet/be_cmds.h b/drivers/net/ethernet/emulex/benet/be_cmds.h index 09da2d82c2f0..8af11a5e49fe 100644 --- a/drivers/net/ethernet/emulex/benet/be_cmds.h +++ b/drivers/net/ethernet/emulex/benet/be_cmds.h @@ -2431,7 +2431,7 @@ int be_cmd_set_beacon_state(struct be_adapter *adapter, u8 port_num, u8 beacon, int be_cmd_get_beacon_state(struct be_adapter *adapter, u8 port_num, u32 *state); int be_cmd_read_port_transceiver_data(struct be_adapter *adapter, - u8 page_num, u8 *data); + u8 page_num, u32 off, u32 len, u8 *data); int be_cmd_query_cable_type(struct be_adapter *adapter); int be_cmd_query_sfp_info(struct be_adapter *adapter); int lancer_cmd_read_object(struct be_adapter *adapter, struct be_dma_mem *cmd, diff --git a/drivers/net/ethernet/emulex/benet/be_ethtool.c b/drivers/net/ethernet/emulex/benet/be_ethtool.c index 56db37d92937..ca7750f483f9 100644 --- a/drivers/net/ethernet/emulex/benet/be_ethtool.c +++ b/drivers/net/ethernet/emulex/benet/be_ethtool.c @@ -1345,7 +1345,7 @@ static int be_get_module_info(struct net_device *netdev, return -EOPNOTSUPP; status = be_cmd_read_port_transceiver_data(adapter, TR_PAGE_A0, - page_data); + 0, PAGE_DATA_LEN, page_data); if (!status) { if (!page_data[SFP_PLUS_SFF_8472_COMP]) { modinfo->type = ETH_MODULE_SFF_8079; @@ -1363,25 +1363,32 @@ static int be_get_module_eeprom(struct net_device *netdev, { struct be_adapter *adapter = netdev_priv(netdev); int status; + u32 begin, end; if (!check_privilege(adapter, MAX_PRIVILEGES)) return -EOPNOTSUPP; - status = be_cmd_read_port_transceiver_data(adapter, TR_PAGE_A0, - data); - if (status) - goto err; + begin = eeprom->offset; + end = eeprom->offset + eeprom->len; + + if (begin < PAGE_DATA_LEN) { + status = be_cmd_read_port_transceiver_data(adapter, TR_PAGE_A0, begin, + min_t(u32, end, PAGE_DATA_LEN) - begin, + data); + if (status) + goto err; + + data += PAGE_DATA_LEN - begin; + begin = PAGE_DATA_LEN; + } - if (eeprom->offset + eeprom->len > PAGE_DATA_LEN) { - status = be_cmd_read_port_transceiver_data(adapter, - TR_PAGE_A2, - data + - PAGE_DATA_LEN); + if (end > PAGE_DATA_LEN) { + status = be_cmd_read_port_transceiver_data(adapter, TR_PAGE_A2, + begin - PAGE_DATA_LEN, + end - begin, data); if (status) goto err; } - if (eeprom->offset) - memcpy(data, data + eeprom->offset, eeprom->len); err: return be_cmd_status(status); } -- 2.35.1