Received-SPF: pass (google.com: domain of linux-kernel+bounces-95841-linux.lists.archive=gmail.com@vger.kernel.org designates 2604:1380:4601:e00::3 as permitted sender) client-ip=2604:1380:4601:e00::3;
Received-SPF: Pass (protection.outlook.com: domain of seco.com designates
 20.160.56.81 as permitted sender) receiver=protection.outlook.com;
 client-ip=20.160.56.81; helo=repost-eu.tmcas.trendmicro.com; pr=C
Authentication-Results-Original: dkim=none (message not signed)
 header.d=none;dmarc=none action=none header.from=seco.com;
Message-ID: <45d1bb23-4559-4b38-8d26-8705541df69f@seco.com>
Date: Thu, 7 Mar 2024 11:06:48 -0500
User-Agent: Mozilla Thunderbird
Subject: Re: [PATCH] fsl/fman: Add array size check
Content-Language: en-US
To: Aleksandr Mishin <amishin@t-argos.ru>,
 Madalin Bucur <madalin.bucur@nxp.com>
Cc: "David S. Miller" <davem@davemloft.net>,
 Eric Dumazet <edumazet@google.com>, Jakub Kicinski <kuba@kernel.org>,
 Paolo Abeni <pabeni@redhat.com>, Igal Liberman
 <igal.liberman@freescale.com>, netdev@vger.kernel.org,
 linux-kernel@vger.kernel.org, lvc-project@linuxtesting.org
References: <20240307080452.13278-1-amishin@t-argos.ru>
From: Sean Anderson <sean.anderson@seco.com>
In-Reply-To: <20240307080452.13278-1-amishin@t-argos.ru>
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
Precedence: bulk
MIME-Version: 1.0
X-Microsoft-Antispam-Message-Info-Original:
 aX5L7umcYILgnYdie60+aysjJsIjWHHFJrahW/V2sUh+5oyNYr8/+Tdfmy2S2s2A5vVjyK7RBf2ZBF4hcdhRI+V0AEjYXqWs0CteepVFZBTa8wXpSOrur2sMi9cvo2Oop/pRet/+SIPNDdGgPpxdXsgLlZu0Z/ifDZNkv4Fymy1vgEPKRLoX0XrSK4RtWNP3vO8FR5rG4ssR/KxrlTcvyFRd3UtMVBt9oKNBVE0hqY4nB8PSU4bZOBCJfJlN1l9TJTxUsjrj/eNGHSfkUYpQqEVy/Z6S8bt/c3HwrWY3KBTSjyM+ugHuhnz/FqSwvmlZbyM/ZCRjC8qc+iB7lNjaT7Jqo4DIKIJHWNgglOHHdkYblgbBT0ddC2jRUsKmdhGvP7rVmXShbzlX/XOPyUgwx7D2SePV2GSaZnV3ehSsjkVvC+mX5amGPNCdT0lvt9/expY5Uk4bQuZdqUdNqR1yMkA0n74QubRsM8WEEp6j8jWmpfdp3/qXpen3zKbubeDn34Gjk3n3xVpIaaiiZeNr1qCes49yxyxZSqTHYM1+ZN1lbxMb9q5aoTTzqGTIoGfWo6H0x2x3wennDkX54ZoN+zSZH9aN+Xfm2U9mOgPLl5Tqq1wWaORS8g8zGPLCIdi5Ee2olbroHzF90UNZ2i1pEW3aGIV07YdjJgeALrBlx0DYPEUYXDe7frP4wD4tOyiY22Q+Si981H2L9FCUtn8dS+tV+8mMu0JA+VWZZSxkkaI=
X-Forefront-Antispam-Report-Untrusted:
 CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:DB9PR03MB8847.eurprd03.prod.outlook.com;PTR:;CAT:NONE;SFS:(13230031)(376005)(38350700005);DIR:OUT;SFP:1102;
X-MS-Exchange-Transport-CrossTenantHeadersStamped: DU0PR03MB9008
X-EOPAttributedMessage: 0
X-MS-Exchange-Transport-CrossTenantHeadersStripped:
 AMS0EPF000001A6.eurprd05.prod.outlook.com
X-MS-PublicTrafficType: Email
X-MS-Office365-Filtering-Correlation-Id-Prvs:
	8fbf39b8-d8ba-445e-0d45-08dc3ec09c80
X-Microsoft-Antispam: BCL:0;
X-Microsoft-Antispam-Message-Info:
	jFnNKTNCawnht9+3UValOwRlnwtJvy8xat1lmVEC7jJy6BOROPlRIfCUGxGWtGGHLEkkHt7FyxYOeh2lowcql96hinYgcdLE0AdWhy+wAzyPuV8CThaJ78agPoZzHxvttmRYVEF8ZQvm4Sq3899aLyZzuxSI2Na0GZ3IlEvkfnFwtEXSsCW2UKHpXNMbVyg2mrNU+G2sVS8g7kOlMjCVzhMR27luONkUAFmVPUT8GBMakzdGkwRuANyylssowQU2fSZz6Op88kXo4v+mYcHScM62e+wJEH0S6IHKV1q4f04ZpzBdo48gx3HLZRaS23Tf6m97nVprRibPOlMZPKQlhnDiHPu210C8yogLDzlD2FppWb6l14n73wBsQAlZ04T+6fiPyRVADp05pyMH6VGhWv7F3AHIHIrwyAVtCeU5BDSHYQy4GHwGU9J2XGoLbwRHKa0tApuVclFPAkVXNJM24Ttqw9W33xvAyZfNIt+9IH+7Y3kcuH4Hwfw/leK42IEfi4W2kCmr9lO0XbTGzVJAnJX5Hig2ih2Zk1G9sfLti0fqPV6yNzkm/YoMdz1B3Pty8YIxdsorSNJZQoe1yJivRDp+3VLqoqTKyvBX5ca2xcLYwanlcB/iZ5JSK9KHfd33COM8hzidetiFdUdcwu+PAWDhyZV3mVseQXFmJFU1NklpPBfbZp0ZKu8cavAGzD3ZzxktwTZAM5V0+4ZqC23yxb6BARbUx1/wXQGFyk7YE6NuBsLRF2eBCqt+IzDez9Z3
X-Forefront-Antispam-Report:
	CIP:20.160.56.81;CTRY:NL;LANG:en;SCL:1;SRV:;IPV:CAL;SFV:NSPM;H:repost-eu.tmcas.trendmicro.com;PTR:repost-eu.tmcas.trendmicro.com;CAT:NONE;SFS:(13230031)(36860700004)(376005)(82310400014);DIR:OUT;SFP:1102;
X-OriginatorOrg: seco.com
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 07 Mar 2024 16:07:00.9822
 (UTC)
X-MS-Exchange-CrossTenant-Network-Message-Id: 44289b72-921b-4f53-b063-08dc3ec09f7e
X-MS-Exchange-CrossTenant-Id: bebe97c3-6438-442e-ade3-ff17aa50e733
X-MS-Exchange-CrossTenant-OriginalAttributedTenantConnectingIp: TenantId=bebe97c3-6438-442e-ade3-ff17aa50e733;Ip=[20.160.56.81];Helo=[repost-eu.tmcas.trendmicro.com]
X-MS-Exchange-CrossTenant-AuthSource:
	AMS0EPF000001A6.eurprd05.prod.outlook.com
X-MS-Exchange-CrossTenant-AuthAs: Anonymous
X-MS-Exchange-CrossTenant-FromEntityHeader: HybridOnPrem
X-MS-Exchange-Transport-CrossTenantHeadersStamped: DB9PR03MB8171

On 3/7/24 03:04, Aleksandr Mishin wrote:
> [You don't often get email from amishin@t-argos.ru. Learn why this is imp=
ortant at https://cas5-0-urlprotect.trendmicro.com:443/wis/clicktime/v1/que=
ry?url=3Dhttps%3a%2f%2faka.ms%2fLearnAboutSenderIdentification&umid=3Dbdb4c=
fa6-c48e-4063-9c43-6d5ce09db688&auth=3Dd807158c60b7d2502abde8a2fc01f4066298=
0862-eff8dde9dd9e5b6c3f9e726ab81488b46e7dd147 ]
>
> In fman_register_intr() and fman_unregister_intr()
> get_module_event() is assigned to event which is then used
> as array index without size check.
> Fix this bug by adding a check of event.
>
> Found by Linux Verification Center (linuxtesting.org) with SVACE.
>
> Fixes: 414fd46e7762 (fsl/fman: Add FMan support)
> Signed-off-by: Aleksandr Mishin <amishin@t-argos.ru>
> ---
>  drivers/net/ethernet/freescale/fman/fman.c | 10 ++++++++--
>  1 file changed, 8 insertions(+), 2 deletions(-)
>
> diff --git a/drivers/net/ethernet/freescale/fman/fman.c b/drivers/net/eth=
ernet/freescale/fman/fman.c
> index d96028f01770..902d05ffff1b 100644
> --- a/drivers/net/ethernet/freescale/fman/fman.c
> +++ b/drivers/net/ethernet/freescale/fman/fman.c
> @@ -2054,7 +2054,10 @@ void fman_register_intr(struct fman *fman, enum fm=
an_event_modules module,
>         int event =3D 0;
>
>         event =3D get_module_event(module, mod_id, intr_type);
> -       WARN_ON(event >=3D FMAN_EV_CNT);
> +       if (event >=3D FMAN_EV_CNT) {
> +               WARN_ON(event >=3D FMAN_EV_CNT);
> +               return;
> +       }
>
>         /* register in local FM structure */
>         fman->intr_mng[event].isr_cb =3D isr_cb;
> @@ -2079,7 +2082,10 @@ void fman_unregister_intr(struct fman *fman, enum =
fman_event_modules module,
>         int event =3D 0;
>
>         event =3D get_module_event(module, mod_id, intr_type);
> -       WARN_ON(event >=3D FMAN_EV_CNT);
> +       if (event >=3D FMAN_EV_CNT) {
> +               WARN_ON(event >=3D FMAN_EV_CNT);
> +               return;
> +       }
>
>         fman->intr_mng[event].isr_cb =3D NULL;
>         fman->intr_mng[event].src_handle =3D NULL;
> --
> 2.30.2
>

Nack. This condition should never occur, that's why we have the WARN_ON.

--Sean

[Embedded World 2024, SECO SpA]<https://www.messe-ticket.de/Nuernberg/embed=
dedworld2024/Register/ew24517689>