Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::3:4 as permitted sender) client-ip=2620:137:e000::3:4;
Date:   Sat, 23 Sep 2023 12:43:59 -0700
From:   Kees Cook <kees@kernel.org>
To:     "Gustavo A. R. Silva" <gustavoars@kernel.org>,
        Ariel Elior <aelior@marvell.com>,
        Manish Chopra <manishc@marvell.com>,
        "David S. Miller" <davem@davemloft.net>,
        Eric Dumazet <edumazet@google.com>,
        Jakub Kicinski <kuba@kernel.org>,
        Paolo Abeni <pabeni@redhat.com>,
        Michal Kalderon <Michal.Kalderon@cavium.com>
CC:     netdev@vger.kernel.org, linux-kernel@vger.kernel.org,
        linux-hardening@vger.kernel.org
Subject: =?US-ASCII?Q?Re=3A_=5BPATCH=5D_qed/red=5Fll2=3A_Fix_undefine?= =?US-ASCII?Q?d_behavior_bug_in_struct_qed=5Fll2=5Finfo?=
User-Agent: K-9 Mail for Android
In-Reply-To: <ZQ+Nz8DfPg56pIzr@work>
References: <ZQ+Nz8DfPg56pIzr@work>
Message-ID: <94131E7C-BC22-423B-8B05-234BB2E09EFD@kernel.org>
MIME-Version: 1.0
Content-Type: text/plain;
 charset=utf-8
Content-Transfer-Encoding: quoted-printable
Precedence: bulk

On September 23, 2023 6:15:59 PM PDT, "Gustavo A=2E R=2E Silva" <gustavoars=
@kernel=2Eorg> wrote:
>The flexible structure (a structure that contains a flexible-array member
>at the end) `qed_ll2_tx_packet` is nested within the second layer of
>`struct qed_ll2_info`:
>
>struct qed_ll2_tx_packet {
>	=2E=2E=2E
>        /* Flexible Array of bds_set determined by max_bds_per_packet */
>        struct {
>                struct core_tx_bd *txq_bd;
>                dma_addr_t tx_frag;
>                u16 frag_len;
>        } bds_set[];
>};
>
>struct qed_ll2_tx_queue {
>	=2E=2E=2E
>	struct qed_ll2_tx_packet cur_completing_packet;
>};
>
>struct qed_ll2_info {
>	=2E=2E=2E
>	struct qed_ll2_tx_queue tx_queue;
>        struct qed_ll2_cbs cbs;
>};

Nice find! Was this located with -Wflex-array-member-not-at-end ?=20

> [=2E=2E=2E]
>Fix this by moving the declaration of `cbs` to the  middle of its
>containing structure `qed_ll2_info`, preventing it from being
>overwritten by the contents of `bds_set` at run-time=2E
>
>This bug was introduced in 2017, when `bds_set` was converted to a
>one-element array, and started to be used as a Variable Length Object
>(VLO) at run-time=2E
>
>Fixes: f5823fe6897c ("qed: Add ll2 option to limit the number of bds per =
packet")
>Cc: stable@vger=2Ekernel=2Eorg
>Signed-off-by: Gustavo A=2E R=2E Silva <gustavoars@kernel=2Eorg>

Reviewed-by: Kees Cook <keescook@chromium=2Eorg>


--=20
Kees Cook