Received-SPF: pass (google.com: domain of linux-kernel+bounces-211993-linux.lists.archive=gmail.com@vger.kernel.org designates 147.75.199.223 as permitted sender) client-ip=147.75.199.223;
From: Sunil Kovvuri Goutham <sgoutham@marvell.com>
To: Huai-Yuan Liu <qq810974084@gmail.com>,
        "jes@trained-monkey.org"
	<jes@trained-monkey.org>,
        "davem@davemloft.net" <davem@davemloft.net>,
        "edumazet@google.com" <edumazet@google.com>,
        "kuba@kernel.org"
	<kuba@kernel.org>,
        "pabeni@redhat.com" <pabeni@redhat.com>
CC: "linux-hippi@sunsite.dk" <linux-hippi@sunsite.dk>,
        "netdev@vger.kernel.org" <netdev@vger.kernel.org>,
        "linux-kernel@vger.kernel.org" <linux-kernel@vger.kernel.org>,
        "baijiaju1990@gmail.com" <baijiaju1990@gmail.com>
Subject: RE: [PATCH] hippi: fix possible buffer overflow caused by bad DMA
 value in rr_start_xmit()
Thread-Topic: [PATCH] hippi: fix possible buffer overflow caused by bad DMA
 value in rr_start_xmit()
Thread-Index: AQHavOzIt3V/K0ewCkme5/aMEUgvUA==
Date: Wed, 12 Jun 2024 17:20:11 +0000
Message-ID: 
 <BY3PR18MB47377555195613DF6731B9DEC6C02@BY3PR18MB4737.namprd18.prod.outlook.com>
References: <20240612093153.297167-1-qq810974084@gmail.com>
In-Reply-To: <20240612093153.297167-1-qq810974084@gmail.com>
Accept-Language: en-US
Content-Language: en-US
x-ms-exchange-antispam-messagedata-chunkcount: 1
x-ms-exchange-antispam-messagedata-0: 
 =?us-ascii?Q?/esUYw2Cpa2lE8GWkVxN1KrQBvB99iseAwSZdcea6RM0R4SPzh/ImfjI5Agz?=
 =?us-ascii?Q?cv4JBeJuPTFuX1lOeNVsiBcjdDMO5aKsEN5uDFiGN6RrB6GU4/wt1CNxK8ei?=
 =?us-ascii?Q?SuMwLfgmqxRoN4ksCScEh6x/RWJTv6SVCKGCo0E4RuYUJbNOIJVios+U7HXN?=
 =?us-ascii?Q?1WMtKL1tg2llyTmM2UGZiGn8TM6U9vKPBnx4aetH9VLvD3i0xuCm3XFKME2N?=
 =?us-ascii?Q?pmvFo48x3lQ6JW2G043A/C+DLQ9wL7A0MMkK9mDrlLMKKBxTgDCEjCcb0ZlS?=
 =?us-ascii?Q?Ju9uQ7u9nnWdPAt5SzdUAIOADAl37QdGVhqnxXdxlxEyjkYKTHURraPBy9Ef?=
 =?us-ascii?Q?xlKXQM/I1nB0y75uNEHYYYDAaUdkaCjsNX8mCGK0DCGbdcPF/AZJdnBm5hKB?=
 =?us-ascii?Q?HHVUBzxHxqNah9kY2cawbeeRIlcs+S8XaPRAPgmk8gE4tJMAbZRTAVXBYo1Z?=
 =?us-ascii?Q?KnA9s58GFH19CMpDW0q66VAu88y3uWfToO/zOGctQQOhql4ZsUKe/Rtx7pyH?=
 =?us-ascii?Q?vodnwFn4j5W67zkr8jITV/wTYJDf98lZMhDJ8uSsG1P+ggMzglhAMCGkgNER?=
 =?us-ascii?Q?rVmEt+l5gPay8epvmFe2MHlXgMJn9HzK/v2aQ6M2P1GU9DkID9TZO7Zp89IM?=
 =?us-ascii?Q?uRQLAyw3cDmg1WHDHFlz++RtgB45ECrYrJK1tlsDNj+cnGs3ZheN3j/KyhsW?=
 =?us-ascii?Q?o+hp8px3vHSf+bmsrc/OZjqCxCaZN8tK1XevYeDskNZEyPpOJi5GHu3QwEWX?=
 =?us-ascii?Q?HlIf85REmmY5FkhUB86XOd6ulLnVjp2xzGPOmSiLmCo4Z240Q42wuRjPHZ9p?=
 =?us-ascii?Q?suZMuDjeQdzylYN11V31VkWpPWpCZLfADZbdMjOOc289k+mYzuFSdyPdFOqD?=
 =?us-ascii?Q?rUUAm8ygRbzbjHSaCDwaS2nBBNJ98tedEwhPPJN2ZriQMmidUVoOsl2AN3A+?=
 =?us-ascii?Q?J++5Dzk/fZZud81uYvdK1RCXUW8MvyhAJAvTWpPJB/bxUXsIPKTEsDR8lgoh?=
 =?us-ascii?Q?Y5E2wJuyOpOsCzsrAZ425tT4STa6O/7PTl8ZlpEh8b5EOe08fBf1br3A75MF?=
 =?us-ascii?Q?UdyhAsXaPcS95Z/XPkUMZB0bm6SO2MACUEe5ULJot09aDgdVOCfLo+M0ODNQ?=
 =?us-ascii?Q?KHtBqG7Pq2/Gz98Yp8KFTfh4zb2L551yghevVCjPpRGmjb1M5acUMY6/oaPV?=
 =?us-ascii?Q?5rHtbB2VFgkij3JXVx0+l7nU2mP8a0YjmKSomT+ex739aKjDLpUsNUI/c3Ms?=
 =?us-ascii?Q?kTNlHGa7Cd48WCFt7Fjfq+SVFC4BVCwo8jtOkfbs4cdYL5a0ElXFj6ClR5hC?=
 =?us-ascii?Q?W4gtEfZt4cEHoB2Ubs3GebbC/BeGBgHoE+VpQ3Fpe+hv447ZYcVVp1dO6oLx?=
 =?us-ascii?Q?G/NFem+lvBiOgRPCClFuUVDUwqNxyv3s2//HP7652ZWIsoFT+YhfPwzfacWz?=
 =?us-ascii?Q?/9v0GyDHpjwUjROEoSSadNUqROEHkMo+5uv3xM29WqAPyg+aYUfou+UGDEl2?=
 =?us-ascii?Q?ur2KbYMqJPWXa5KILkExY74GMRronS8r4M6FYR2xh0zHJWXU93LYCI/j17ko?=
 =?us-ascii?Q?3bcuhuUqgdDuoPhzn3mbbOTvn0K86sobsqynzMje?=
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: quoted-printable
Precedence: bulk
X-Mailing-List: linux-kernel@vger.kernel.org
List-Id: <linux-kernel.vger.kernel.org>
List-Subscribe: <mailto:linux-kernel+subscribe@vger.kernel.org>
List-Unsubscribe: <mailto:linux-kernel+unsubscribe@vger.kernel.org>
MIME-Version: 1.0
X-OriginatorOrg: marvell.com
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-AuthSource: BY3PR18MB4737.namprd18.prod.outlook.com
X-MS-Exchange-CrossTenant-Network-Message-Id: a103b9e1-d5a8-4a35-86ed-08dc8b03eac1
X-MS-Exchange-CrossTenant-originalarrivaltime: 12 Jun 2024 17:20:11.9217
 (UTC)
X-MS-Exchange-CrossTenant-fromentityheader: Hosted
X-MS-Exchange-CrossTenant-id: 70e1fb47-1155-421d-87fc-2e58f638b6e0
X-MS-Exchange-CrossTenant-mailboxtype: HOSTED
X-MS-Exchange-CrossTenant-userprincipalname: uVD60SYc2HR7gfkmbPRGvYpsm28jGTxTZK/Vj3Mjh6uohEzkdYeYjTKYRnbtB2zKJxM/+i1Wwnkr902yUsbrSQ==
X-MS-Exchange-Transport-CrossTenantHeadersStamped: IA1PR18MB5492
X-Proofpoint-GUID: qY84-WlLZCKrqFvJ3ZpuxylwYNCO3-kS
X-Proofpoint-ORIG-GUID: qY84-WlLZCKrqFvJ3ZpuxylwYNCO3-kS
X-Proofpoint-Virus-Version: vendor=baseguard
 engine=ICAP:2.0.293,Aquarius:18.0.1039,Hydra:6.0.680,FMLib:17.12.28.16
 definitions=2024-06-12_08,2024-06-12_02,2024-05-17_01


>-----Original Message-----
>From: Huai-Yuan Liu <qq810974084@gmail.com>
>Sent: Wednesday, June 12, 2024 3:02 PM
>To: jes@trained-monkey.org; davem@davemloft.net; edumazet@google.com;
>kuba@kernel.org; pabeni@redhat.com
>Cc: linux-hippi@sunsite.dk; netdev@vger.kernel.org; linux-kernel@vger.kern=
el.org;
>baijiaju1990@gmail.com; Huai-Yuan Liu <qq810974084@gmail.com>
>Subject: [EXTERNAL] [PATCH] hippi: fix possible buffer overflow caused by =
bad DMA
>value in rr_start_xmit()
>
>The value rrpriv->info->tx_ctrl is stored in DMA memory, and it is assigne=
d to txctrl,
>so txctrl->pi can be modified at any time by malicious hardware. Becausetx=
ctrl->pi is
>assigned to index, buffer overflow may occur when the code
>
>The value rrpriv->info->tx_ctrl is stored in DMA memory, and it is assigne=
d to txctrl,
>so txctrl->pi can be modified at any time by malicious hardware. Becausetx=
ctrl->pi is
>assigned to index, buffer overflow may occur when the code "rrpriv-
>>tx_skbuff[index]" is executed.
>
>To address this issue, the index should be checked.
>
>Fixes: f33a7251c825 ("hippi: switch from 'pci_' to 'dma_' API")
>Signed-off-by: Huai-Yuan Liu <qq810974084@gmail.com>
>---

LGTM
Reviewed-by: Sunil Goutham <sgoutham@marvell.com>