Ksawlii/kernel_samsung_a53x
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
kernel_samsung_a53x/drivers/net
History
Shifeng Li ae301c670a net/mlx5e: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list() 
[ Upstream commit ddb38ddff9c71026bad481b791a94d446ee37603 ]

Out_sz that the size of out buffer is calculated using query_nic_vport
_context_in structure when driver query the MAC list. However query_nic
_vport_context_in structure is smaller than query_nic_vport_context_out.
When allowed_list_size is greater than 96, calling ether_addr_copy() will
trigger an slab-out-of-bounds.

[ 1170.055866] BUG: KASAN: slab-out-of-bounds in mlx5_query_nic_vport_mac_list+0x481/0x4d0 [mlx5_core]
[ 1170.055869] Read of size 4 at addr ffff88bdbc57d912 by task kworker/u128:1/461
[ 1170.055870]
[ 1170.055932] Workqueue: mlx5_esw_wq esw_vport_change_handler [mlx5_core]
[ 1170.055936] Call Trace:
[ 1170.055949]  dump_stack+0x8b/0xbb
[ 1170.055958]  print_address_description+0x6a/0x270
[ 1170.055961]  kasan_report+0x179/0x2c0
[ 1170.056061]  mlx5_query_nic_vport_mac_list+0x481/0x4d0 [mlx5_core]
[ 1170.056162]  esw_update_vport_addr_list+0x2c5/0xcd0 [mlx5_core]
[ 1170.056257]  esw_vport_change_handle_locked+0xd08/0x1a20 [mlx5_core]
[ 1170.056377]  esw_vport_change_handler+0x6b/0x90 [mlx5_core]
[ 1170.056381]  process_one_work+0x65f/0x12d0
[ 1170.056383]  worker_thread+0x87/0xb50
[ 1170.056390]  kthread+0x2e9/0x3a0
[ 1170.056394]  ret_from_fork+0x1f/0x40

Fixes: e16aea2744ab ("net/mlx5: Introduce access functions to modify/query vport mac lists")
Cc: Ding Hui <dinghui@sangfor.com.cn>
Signed-off-by: Shifeng Li <lishifeng@sangfor.com.cn>
Reviewed-by: Simon Horman <horms@kernel.org>
Signed-off-by: Saeed Mahameed <saeedm@nvidia.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2024-11-18 12:11:58 +01:00
..
appletalk Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
arcnet arcnet: restoring support for multiple Sohard Arcnet cards 2024-11-18 12:11:39 +01:00
bonding bonding: stop the device in bond_setup_by_slave() 2024-11-18 11:43:19 +01:00
caif Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
can can: dev: can_restart(): fix race condition between controller restart and netif_carrier_on() 2024-11-18 11:42:49 +01:00
dropdump Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
dsa net: dsa: lan9303: consequently nested-lock physical MDIO 2024-11-18 11:43:30 +01:00
ethernet net/mlx5e: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list() 2024-11-18 12:11:58 +01:00
fddi Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
fjes Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
hamradio Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
hippi Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
hyperv hv_netvsc: rndis_filter needs to select NLS 2024-11-18 12:11:39 +01:00
ieee802154 net: ieee802154: adf7242: Fix some potential buffer overflow in adf7242_stats_show() 2024-11-18 10:58:29 +01:00
ipa Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
ipvlan ipvlan: add ipvlan_route_v6_outbound() helper 2024-11-18 11:43:19 +01:00
mdio Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
netdevsim Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
pcs Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
phy net: phylink: initialize carrier state at creation 2024-11-18 11:43:30 +01:00
plip Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
ppp ppp: limit MRU to 64K 2024-11-18 11:43:19 +01:00
slip Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
team team: Fix use-after-free when an option instance allocation fails 2024-11-18 12:11:57 +01:00
usb net: usb: qmi_wwan: claim interface 4 for ZTE MF290 2024-11-18 12:11:57 +01:00
vmxnet3 Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
vxlan Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
wan Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
wimax Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
wireguard wireguard: use DEV_STATS_INC() 2024-11-18 12:10:54 +01:00
wireless wifi: ath11k: fix htt pktlog locking 2024-11-18 11:43:25 +01:00
xen-netback xen-netback: use default TX queue size for vifs 2024-11-08 11:25:45 +01:00
bareudp.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
dummy.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
eql.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
geneve.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
gtp.c gtp: fix fragmentation needed check with gso 2024-11-18 10:58:30 +01:00
ifb.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
Kconfig Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
LICENSE.SRC Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
loopback.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
macsec.c net: macsec: indicate next pn update when offloading 2024-11-08 11:25:46 +01:00
macvlan.c macvlan: Don't propagate promisc change to lower dev in passthru 2024-11-18 11:43:20 +01:00
macvtap.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
Makefile Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
mdio.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
mii.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
net_failover.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
netconsole.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
nlmon.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
ntb_netdev.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
rionet.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
sb1000.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
Space.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
sungem_phy.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
tap.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
thunderbolt.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
tun.c tun: prevent negative ifindex 2024-11-08 11:26:10 +01:00
veth.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
virtio_net.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
vrf.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
vsockmon.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
xen-netfront.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00