Re: [PATCH] bnxt: Do not read past the end of test names

[Michael Chan]

On Wed, Jan 18, 2023 at 12:35 PM Kees Cook <keescook@xxxxxxxxxxxx> wrote:
>
> Test names were being concatenated based on a offset beyond the end of
> the first name, which tripped the buffer overflow detection logic:
>
>  detected buffer overflow in strnlen
>  [...]
>  Call Trace:
>  bnxt_ethtool_init.cold+0x18/0x18
>
> Refactor struct hwrm_selftest_qlist_output to use an actual array,
> and adjust the concatenation to use snprintf() rather than a series of
> strncat() calls.
>
> Reported-by: Niklas Cassel <Niklas.Cassel@xxxxxxx>
> Link: https://lore.kernel.org/lkml/Y8F%2F1w1AZTvLglFX@x1-carbon/
> Tested-by: Niklas Cassel <Niklas.Cassel@xxxxxxx>
> Fixes: eb51365846bc ("bnxt_en: Add basic ethtool -t selftest support.")
> Cc: Michael Chan <michael.chan@xxxxxxxxxxxx>
> Cc: "David S. Miller" <davem@xxxxxxxxxxxxx>
> Cc: Eric Dumazet <edumazet@xxxxxxxxxx>
> Cc: Jakub Kicinski <kuba@xxxxxxxxxx>
> Cc: Paolo Abeni <pabeni@xxxxxxxxxx>
> Cc: netdev@xxxxxxxxxxxxxxx
> Signed-off-by: Kees Cook <keescook@xxxxxxxxxxxx>

Reviewed-by: Michael Chan <michael.chan@xxxxxxxxxxxx>

> diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt_hsi.h b/drivers/net/ethernet/broadcom/bnxt/bnxt_hsi.h
> index 2686a714a59f..a5408879e077 100644
> --- a/drivers/net/ethernet/broadcom/bnxt/bnxt_hsi.h
> +++ b/drivers/net/ethernet/broadcom/bnxt/bnxt_hsi.h
> @@ -10249,14 +10249,7 @@ struct hwrm_selftest_qlist_output {
>         u8      unused_0;
>         __le16  test_timeout;
>         u8      unused_1[2];
> -       char    test0_name[32];
> -       char    test1_name[32];
> -       char    test2_name[32];
> -       char    test3_name[32];
> -       char    test4_name[32];
> -       char    test5_name[32];
> -       char    test6_name[32];
> -       char    test7_name[32];
> +       char    test_name[8][32];

bnxt_hsi.h is a generated file.  I will need to make a request so that
future versions will be generated like this.

Thanks.

>         u8      eyescope_target_BER_support;
>         #define SELFTEST_QLIST_RESP_EYESCOPE_TARGET_BER_SUPPORT_BER_1E8_SUPPORTED  0x0UL
>         #define SELFTEST_QLIST_RESP_EYESCOPE_TARGET_BER_SUPPORT_BER_1E9_SUPPORTED  0x1UL
> --
> 2.34.1
>

Attachment: smime.p7s
Description: S/MIME Cryptographic Signature