| Message ID | 20231121184543.3433940-1-sgzhang@google.com (mailing list archive) |
|---|---|
| State | Changes Requested |
| Delegated to: | Netdev Maintainers |
| Headers | show |
| Series | net: stmmac: fix out-of-bounds read via memcpy detected by KASAN | expand |
On Tue, Nov 21, 2023 at 06:45:43PM +0000, Ray Zhang wrote: > CONFIG_KASAN detected out-of-bounds read via memcpy in stmmac_get_strings. > The fix is to change memcpy to strscpy. > > Tested: > <machine_obfuscated>:~# ethtool -i <interface_obfuscated> > driver: st_gmac > <machine_obfuscated>:~# ethtool -S <interface_obfuscated> > NIC statistics: > ATPES: 0 > TPES: 0 > RDPES: 0 > MPES: 0 > MTSPES: 0 > ARPES: 0 > CWPES: 0 > ASRPES: 0 > TTES: 0 > RTES: 0 > CTES: 0 > ATES: 0 > PTES: 0 > T125ES: 0 > R125ES: 0 > RVCTES: 0 > MSTTES: 0 > SLVTES: 0 > ATITES: 0 > ARITES: 0 > FSMPES: 0 > TXCES: 0 > TXAMS: 0 > TXUES: 0 > RXCES: 0 > RXAMS: 0 > RXUES: 0 > ECES: 0 > EAMS: 0 > EUES: 0 > RPCES: 0 > RPAMS: 0 > RPUES: 0 > TCES: 0 > TAMS: 0 > TUES: 0 > mmc_tx_octetcount_gb: 11612 > mmc_tx_framecount_gb: 100 > mmc_tx_broadcastframe_g: 0 > mmc_tx_multicastframe_g: 42 > mmc_tx_64_octets_gb: 0 > mmc_tx_65_to_127_octets_gb: 62 > mmc_tx_128_to_255_octets_gb: 38 > mmc_tx_256_to_511_octets_gb: 0 > mmc_tx_512_to_1023_octets_gb: 0 > mmc_tx_1024_to_max_octets_gb: 0 > mmc_tx_unicast_gb: 58 > mmc_tx_multicast_gb: 42 > mmc_tx_broadcast_gb: 0 > mmc_tx_underflow_error: 0 > mmc_tx_singlecol_g: 0 > mmc_tx_multicol_g: 0 > mmc_tx_deferred: 0 > mmc_tx_latecol: 0 > mmc_tx_exesscol: 0 > mmc_tx_carrier_error: 0 > mmc_tx_octetcount_g: 11612 > mmc_tx_framecount_g: 100 > mmc_tx_excessdef: 0 > mmc_tx_pause_frame: 0 > mmc_tx_vlan_frame_g: 0 > mmc_rx_framecount_gb: 64 > mmc_rx_octetcount_gb: 30235 > mmc_rx_octetcount_g: 30235 > mmc_rx_broadcastframe_g: 0 > mmc_rx_multicastframe_g: 0 > mmc_rx_crc_error: 0 > mmc_rx_align_error: 0 > mmc_rx_run_error: 0 > mmc_rx_jabber_error: 0 > mmc_rx_undersize_g: 0 > mmc_rx_oversize_g: 0 > mmc_rx_64_octets_gb: 0 > mmc_rx_65_to_127_octets_gb: 9 > mmc_rx_128_to_255_octets_gb: 22 > mmc_rx_256_to_511_octets_gb: 21 > mmc_rx_512_to_1023_octets_gb: 2 > mmc_rx_1024_to_max_octets_gb: 10 > mmc_rx_unicast_g: 64 > mmc_rx_length_error: 0 > mmc_rx_autofrangetype: 0 > mmc_rx_pause_frames: 0 > mmc_rx_fifo_overflow: 0 > mmc_rx_vlan_frames_gb: 0 > mmc_rx_watchdog_error: 0 > mmc_rx_ipc_intr_mask: 0 > mmc_rx_ipc_intr: 0 > mmc_rx_ipv4_gd: 0 > mmc_rx_ipv4_hderr: 0 > mmc_rx_ipv4_nopay: 0 > mmc_rx_ipv4_frag: 0 > mmc_rx_ipv4_udsbl: 0 > mmc_rx_ipv4_gd_octets: 0 > mmc_rx_ipv4_hderr_octets: 0 > mmc_rx_ipv4_nopay_octets: 0 > mmc_rx_ipv4_frag_octets: 0 > mmc_rx_ipv4_udsbl_octets: 0 > mmc_rx_ipv6_gd_octets: 0 > mmc_rx_ipv6_hderr_octets: 0 > mmc_rx_ipv6_nopay_octets: 0 > mmc_rx_ipv6_gd: 0 > mmc_rx_ipv6_hderr: 0 > mmc_rx_ipv6_nopay: 0 > mmc_rx_udp_gd: 0 > mmc_rx_udp_err: 0 > mmc_rx_tcp_gd: 0 > mmc_rx_tcp_err: 0 > mmc_rx_icmp_gd: 0 > mmc_rx_icmp_err: 0 > mmc_rx_udp_gd_octets: 0 > mmc_rx_udp_err_octets: 0 > mmc_rx_tcp_gd_octets: 0 > mmc_rx_tcp_err_octets: 0 > mmc_rx_icmp_gd_octets: 0 > mmc_rx_icmp_err_octets: 0 > mmc_tx_fpe_fragment_cntr: 0 > mmc_tx_hold_req_cntr: 0 > mmc_rx_packet_assembly_err_cntr: 0 > mmc_rx_packet_smd_err_cntr: 0 > mmc_rx_packet_assembly_ok_cntr: 0 > mmc_rx_fpe_fragment_cntr: 0 > tx_underflow: 0 > tx_carrier: 0 > tx_losscarrier: 0 > vlan_tag: 0 > tx_deferred: 0 > tx_vlan: 0 > tx_jabber: 0 > tx_frame_flushed: 0 > tx_payload_error: 0 > tx_ip_header_error: 0 > rx_desc: 0 > sa_filter_fail: 0 > overflow_error: 0 > ipc_csum_error: 0 > rx_collision: 0 > rx_crc_errors: 0 > dribbling_bit: 0 > rx_length: 0 > rx_mii: 0 > rx_multicast: 0 > rx_gmac_overflow: 0 > rx_watchdog: 0 > da_rx_filter_fail: 0 > sa_rx_filter_fail: 0 > rx_missed_cntr: 0 > rx_overflow_cntr: 0 > rx_vlan: 0 > rx_split_hdr_pkt_n: 0 > tx_undeflow_irq: 0 > tx_process_stopped_irq: 0 > tx_jabber_irq: 0 > rx_overflow_irq: 0 > rx_buf_unav_irq: 0 > rx_process_stopped_irq: 0 > rx_watchdog_irq: 0 > tx_early_irq: 0 > fatal_bus_error_irq: 0 > rx_early_irq: 0 > threshold: 64 > tx_pkt_n: 100 > rx_pkt_n: 64 > normal_irq_n: 62 > rx_normal_irq_n: 58 > napi_poll: 215 > tx_normal_irq_n: 4 > tx_clean: 157 > tx_set_ic_bit: 4 > irq_receive_pmt_irq_n: 0 > mmc_tx_irq_n: 0 > mmc_rx_irq_n: 0 > mmc_rx_csum_offload_irq_n: 0 > irq_tx_path_in_lpi_mode_n: 0 > irq_tx_path_exit_lpi_mode_n: 0 > irq_rx_path_in_lpi_mode_n: 0 > irq_rx_path_exit_lpi_mode_n: 0 > phy_eee_wakeup_error_n: 0 > ip_hdr_err: 0 > ip_payload_err: 0 > ip_csum_bypassed: 0 > ipv4_pkt_rcvd: 0 > ipv6_pkt_rcvd: 64 > no_ptp_rx_msg_type_ext: 64 > ptp_rx_msg_type_sync: 0 > ptp_rx_msg_type_follow_up: 0 > ptp_rx_msg_type_delay_req: 0 > ptp_rx_msg_type_delay_resp: 0 > ptp_rx_msg_type_pdelay_req: 0 > ptp_rx_msg_type_pdelay_resp: 0 > ptp_rx_msg_type_pdelay_follow_up: 0 > ptp_rx_msg_type_announce: 0 > ptp_rx_msg_type_management: 0 > ptp_rx_msg_pkt_reserved_type: 0 > ptp_frame_type: 0 > ptp_ver: 0 > timestamp_dropped: 0 > av_pkt_rcvd: 0 > av_tagged_pkt_rcvd: 0 > vlan_tag_priority_val: 0 > l3_filter_match: 0 > l4_filter_match: 0 > l3_l4_filter_no_match: 0 > irq_pcs_ane_n: 0 > irq_pcs_link_n: 0 > irq_rgmii_n: 0 > mtl_tx_status_fifo_full: 0 > mtl_tx_fifo_not_empty: 0 > mmtl_fifo_ctrl: 0 > mtl_tx_fifo_read_ctrl_write: 0 > mtl_tx_fifo_read_ctrl_wait: 0 > mtl_tx_fifo_read_ctrl_read: 0 > mtl_tx_fifo_read_ctrl_idle: 0 > mac_tx_in_pause: 0 > mac_tx_frame_ctrl_xfer: 0 > mac_tx_frame_ctrl_idle: 0 > mac_tx_frame_ctrl_wait: 0 > mac_tx_frame_ctrl_pause: 0 > mac_gmii_tx_proto_engine: 0 > mtl_rx_fifo_fill_level_full: 0 > mtl_rx_fifo_fill_above_thresh: 0 > mtl_rx_fifo_fill_below_thresh: 0 > mtl_rx_fifo_fill_level_empty: 0 > mtl_rx_fifo_read_ctrl_flush: 0 > mtl_rx_fifo_read_ctrl_read_data: 0 > mtl_rx_fifo_read_ctrl_status: 0 > mtl_rx_fifo_read_ctrl_idle: 0 > mtl_rx_fifo_ctrl_active: 0 > mac_rx_frame_ctrl_fifo: 0 > mac_gmii_rx_proto_engine: 0 > tx_tso_frames: 0 > tx_tso_nfrags: 0 > mtl_est_cgce: 0 > mtl_est_hlbs: 0 > mtl_est_hlbf: 0 > mtl_est_btre: 0 > mtl_est_btrlm: 0 > q0_tx_pkt_n: 100 > q0_tx_irq_n: 4 > q0_rx_pkt_n: 64 > q0_rx_irq_n: 58 What useful information does this list of statistics bring in the commit message? > if (!stmmac_safety_feat_dump(priv, > &priv->sstats, i, > NULL, &desc)) { > - memcpy(p, desc, ETH_GSTRING_LEN); > + strscpy(p, desc, ETH_GSTRING_LEN); Did you consider ethtool_puts() ? Andrew --- pw-bot: cr
> > q0_tx_irq_n: 4 > > q0_rx_pkt_n: 64 > > q0_rx_irq_n: 58 > > What useful information does this list of statistics bring in the > commit message? > > Each output line of "ethtool -S" is from the modified code: It shows the > command still yields normal output results as expected. Does it? Can you actually say that looking at it? > No, since strscpy does the job already. Also I could not find ethtool_puts: > where is it defined? Or do you mean ethtool_put_stat, which is inappropriate to > use here since it requires a skb parameter? https://patchwork.kernel.org/project/netdevbpf/patch/20231102-ethtool_puts_impl-v4-3-14e1e9278496@google.com/ Maybe check with Justin when we will resend that patch. Andrew
On Tue, Nov 21, 2023 at 12:36 PM Andrew Lunn <andrew@lunn.ch> wrote: > > > > q0_tx_irq_n: 4 > > > q0_rx_pkt_n: 64 > > > q0_rx_irq_n: 58 > > > > What useful information does this list of statistics bring in the > > commit message? > > > > Each output line of "ethtool -S" is from the modified code: It shows the > > command still yields normal output results as expected. > > Does it? Can you actually say that looking at it? > Yes, I had debugging pr_err output: [ 478.894392] STMMAC_SAFETY_FEAT i=0, desc=ATPES (len 6) [ 478.899709] STMMAC_SAFETY_FEAT i=1, desc=TPES (len 5) [ 478.905031] STMMAC_SAFETY_FEAT i=2, desc=RDPES (len 6) [ 478.910871] STMMAC_SAFETY_FEAT i=3, desc=MPES (len 5) [ 478.916095] STMMAC_SAFETY_FEAT i=4, desc=MTSPES (len 7) [ 478.921379] STMMAC_SAFETY_FEAT i=5, desc=ARPES (len 6) [ 478.926517] STMMAC_SAFETY_FEAT i=6, desc=CWPES (len 6) [ 478.931645] STMMAC_SAFETY_FEAT i=7, desc=ASRPES (len 7) [ 478.936858] STMMAC_SAFETY_FEAT i=8, desc=TTES (len 5) [ 478.942393] STMMAC_SAFETY_FEAT i=9, desc=RTES (len 5) [ 478.947845] STMMAC_SAFETY_FEAT i=10, desc=CTES (len 5) [ 478.953220] STMMAC_SAFETY_FEAT i=11, desc=ATES (len 5) [ 478.958524] STMMAC_SAFETY_FEAT i=12, desc=PTES (len 5) [ 478.963828] STMMAC_SAFETY_FEAT i=13, desc=T125ES (len 7) [ 478.969224] STMMAC_SAFETY_FEAT i=14, desc=R125ES (len 7) [ 478.975814] STMMAC_SAFETY_FEAT i=15, desc=RVCTES (len 7) [ 478.981215] STMMAC_SAFETY_FEAT i=16, desc=MSTTES (len 7) [ 478.986599] STMMAC_SAFETY_FEAT i=17, desc=SLVTES (len 7) [ 478.992014] STMMAC_SAFETY_FEAT i=18, desc=ATITES (len 7) [ 478.997435] STMMAC_SAFETY_FEAT i=19, desc=ARITES (len 7) [ 479.003322] STMMAC_SAFETY_FEAT i=24, desc=FSMPES (len 7) [ 479.009327] STMMAC_SAFETY_FEAT i=32, desc=TXCES (len 6) [ 479.014637] STMMAC_SAFETY_FEAT i=33, desc=TXAMS (len 6) [ 479.019921] STMMAC_SAFETY_FEAT i=34, desc=TXUES (len 6) [ 479.025223] STMMAC_SAFETY_FEAT i=36, desc=RXCES (len 6) [ 479.030500] STMMAC_SAFETY_FEAT i=37, desc=RXAMS (len 6) [ 479.035792] STMMAC_SAFETY_FEAT i=38, desc=RXUES (len 6) [ 479.041669] STMMAC_SAFETY_FEAT i=40, desc=ECES (len 5) [ 479.047457] STMMAC_SAFETY_FEAT i=41, desc=EAMS (len 5) [ 479.053143] STMMAC_SAFETY_FEAT i=42, desc=EUES (len 5) [ 479.058443] STMMAC_SAFETY_FEAT i=44, desc=RPCES (len 6) [ 479.063739] STMMAC_SAFETY_FEAT i=45, desc=RPAMS (len 6) [ 479.069331] STMMAC_SAFETY_FEAT i=46, desc=RPUES (len 6) [ 479.075499] STMMAC_SAFETY_FEAT i=64, desc=TCES (len 5) [ 479.080711] STMMAC_SAFETY_FEAT i=65, desc=TAMS (len 5) [ 479.086348] STMMAC_SAFETY_FEAT i=66, desc=TUES (len 5) [ 479.091573] STMMAC_MMC_STATS i=0, stat_string=mmc_tx_octetcount_gb (len 21) [ 479.098852] STMMAC_MMC_STATS i=1, stat_string=mmc_tx_framecount_gb (len 21) [ 479.106581] STMMAC_MMC_STATS i=2, stat_string=mmc_tx_broadcastframe_g (len 24) [ 479.113988] STMMAC_MMC_STATS i=3, stat_string=mmc_tx_multicastframe_g (len 24) [ 479.121221] STMMAC_MMC_STATS i=4, stat_string=mmc_tx_64_octets_gb (len 20) [ 479.128558] STMMAC_MMC_STATS i=5, stat_string=mmc_tx_65_to_127_octets_gb (len 27) [ 479.136418] STMMAC_MMC_STATS i=6, stat_string=mmc_tx_128_to_255_octets_gb (len 28) [ 479.144041] STMMAC_MMC_STATS i=7, stat_string=mmc_tx_256_to_511_octets_gb (len 28) [ 479.151663] STMMAC_MMC_STATS i=8, stat_string=mmc_tx_512_to_1023_octets_gb (len 29) [ 479.159495] STMMAC_MMC_STATS i=9, stat_string=mmc_tx_1024_to_max_octets_gb (len 29) [ 479.167255] STMMAC_MMC_STATS i=10, stat_string=mmc_tx_unicast_gb (len 18) [ 479.174755] STMMAC_MMC_STATS i=11, stat_string=mmc_tx_multicast_gb (len 20) [ 479.181826] STMMAC_MMC_STATS i=12, stat_string=mmc_tx_broadcast_gb (len 20) [ 479.188892] STMMAC_MMC_STATS i=13, stat_string=mmc_tx_underflow_error (len 23) [ 479.196211] STMMAC_MMC_STATS i=14, stat_string=mmc_tx_singlecol_g (len 19) [ 479.203783] STMMAC_MMC_STATS i=15, stat_string=mmc_tx_multicol_g (len 18) [ 479.211106] STMMAC_MMC_STATS i=16, stat_string=mmc_tx_deferred (len 16) [ 479.217826] STMMAC_MMC_STATS i=17, stat_string=mmc_tx_latecol (len 15) [ 479.224438] STMMAC_MMC_STATS i=18, stat_string=mmc_tx_exesscol (len 16) [ 479.231523] STMMAC_MMC_STATS i=19, stat_string=mmc_tx_carrier_error (len 21) [ 479.239095] STMMAC_MMC_STATS i=20, stat_string=mmc_tx_octetcount_g (len 20) [ 479.246178] STMMAC_MMC_STATS i=21, stat_string=mmc_tx_framecount_g (len 20) [ 479.253215] STMMAC_MMC_STATS i=22, stat_string=mmc_tx_excessdef (len 17) [ 479.260032] STMMAC_MMC_STATS i=23, stat_string=mmc_tx_pause_frame (len 19) [ 479.267486] STMMAC_MMC_STATS i=24, stat_string=mmc_tx_vlan_frame_g (len 20) [ 479.274846] STMMAC_MMC_STATS i=25, stat_string=mmc_rx_framecount_gb (len 21) [ 479.282005] STMMAC_MMC_STATS i=26, stat_string=mmc_rx_octetcount_gb (len 21) [ 479.289186] STMMAC_MMC_STATS i=27, stat_string=mmc_rx_octetcount_g (len 20) [ 479.296734] STMMAC_MMC_STATS i=28, stat_string=mmc_rx_broadcastframe_g (len 24) [ 479.304493] STMMAC_MMC_STATS i=29, stat_string=mmc_rx_multicastframe_g (len 24) [ 479.312253] STMMAC_MMC_STATS i=30, stat_string=mmc_rx_crc_error (len 17) [ 479.319095] STMMAC_MMC_STATS i=31, stat_string=mmc_rx_align_error (len 19) [ 479.326165] STMMAC_MMC_STATS i=32, stat_string=mmc_rx_run_error (len 17) [ 479.333660] STMMAC_MMC_STATS i=33, stat_string=mmc_rx_jabber_error (len 20) [ 479.340771] STMMAC_MMC_STATS i=34, stat_string=mmc_rx_undersize_g (len 19) [ 479.348068] STMMAC_MMC_STATS i=35, stat_string=mmc_rx_oversize_g (len 18) [ 479.354991] STMMAC_MMC_STATS i=36, stat_string=mmc_rx_64_octets_gb (len 20) [ 479.362603] STMMAC_MMC_STATS i=37, stat_string=mmc_rx_65_to_127_octets_gb (len 27) [ 479.370270] STMMAC_MMC_STATS i=38, stat_string=mmc_rx_128_to_255_octets_gb (len 28) [ 479.378296] STMMAC_MMC_STATS i=39, stat_string=mmc_rx_256_to_511_octets_gb (len 28) [ 479.386073] STMMAC_MMC_STATS i=40, stat_string=mmc_rx_512_to_1023_octets_gb (len 29) [ 479.394288] STMMAC_MMC_STATS i=41, stat_string=mmc_rx_1024_to_max_octets_gb (len 29) [ 479.402684] STMMAC_MMC_STATS i=42, stat_string=mmc_rx_unicast_g (len 17) [ 479.409814] STMMAC_MMC_STATS i=43, stat_string=mmc_rx_length_error (len 20) [ 479.416918] STMMAC_MMC_STATS i=44, stat_string=mmc_rx_autofrangetype (len 22) [ 479.424442] STMMAC_MMC_STATS i=45, stat_string=mmc_rx_pause_frames (len 20) [ 479.431496] STMMAC_MMC_STATS i=46, stat_string=mmc_rx_fifo_overflow (len 21) [ 479.439027] STMMAC_MMC_STATS i=47, stat_string=mmc_rx_vlan_frames_gb (len 22) [ 479.446291] STMMAC_MMC_STATS i=48, stat_string=mmc_rx_watchdog_error (len 22) [ 479.454142] STMMAC_MMC_STATS i=49, stat_string=mmc_rx_ipc_intr_mask (len 21) [ 479.461296] STMMAC_MMC_STATS i=50, stat_string=mmc_rx_ipc_intr (len 16) [ 479.468000] STMMAC_MMC_STATS i=51, stat_string=mmc_rx_ipv4_gd (len 15) [ 479.474577] STMMAC_MMC_STATS i=52, stat_string=mmc_rx_ipv4_hderr (len 18) [ 479.481716] STMMAC_MMC_STATS i=53, stat_string=mmc_rx_ipv4_nopay (len 18) [ 479.489143] STMMAC_MMC_STATS i=54, stat_string=mmc_rx_ipv4_frag (len 17) [ 479.495926] STMMAC_MMC_STATS i=55, stat_string=mmc_rx_ipv4_udsbl (len 18) [ 479.503251] STMMAC_MMC_STATS i=56, stat_string=mmc_rx_ipv4_gd_octets (len 22) [ 479.511207] STMMAC_MMC_STATS i=57, stat_string=mmc_rx_ipv4_hderr_octets (len 25) [ 479.519274] STMMAC_MMC_STATS i=58, stat_string=mmc_rx_ipv4_nopay_octets (len 25) [ 479.527106] STMMAC_MMC_STATS i=59, stat_string=mmc_rx_ipv4_frag_octets (len 24) [ 479.534839] STMMAC_MMC_STATS i=60, stat_string=mmc_rx_ipv4_udsbl_octets (len 25) [ 479.543108] STMMAC_MMC_STATS i=61, stat_string=mmc_rx_ipv6_gd_octets (len 22) [ 479.551189] STMMAC_MMC_STATS i=62, stat_string=mmc_rx_ipv6_hderr_octets (len 25) [ 479.558948] STMMAC_MMC_STATS i=63, stat_string=mmc_rx_ipv6_nopay_octets (len 25) [ 479.566482] STMMAC_MMC_STATS i=64, stat_string=mmc_rx_ipv6_gd (len 15) [ 479.573359] STMMAC_MMC_STATS i=65, stat_string=mmc_rx_ipv6_hderr (len 18) [ 479.580295] STMMAC_MMC_STATS i=66, stat_string=mmc_rx_ipv6_nopay (len 18) [ 479.587919] STMMAC_MMC_STATS i=67, stat_string=mmc_rx_udp_gd (len 14) [ 479.594580] STMMAC_MMC_STATS i=68, stat_string=mmc_rx_udp_err (len 15) [ 479.601159] STMMAC_MMC_STATS i=69, stat_string=mmc_rx_tcp_gd (len 14) [ 479.608608] STMMAC_MMC_STATS i=70, stat_string=mmc_rx_tcp_err (len 15) [ 479.615219] STMMAC_MMC_STATS i=71, stat_string=mmc_rx_icmp_gd (len 15) [ 479.623283] STMMAC_MMC_STATS i=72, stat_string=mmc_rx_icmp_err (len 16) [ 479.630368] STMMAC_MMC_STATS i=73, stat_string=mmc_rx_udp_gd_octets (len 21) [ 479.637536] STMMAC_MMC_STATS i=74, stat_string=mmc_rx_udp_err_octets (len 22) [ 479.644805] STMMAC_MMC_STATS i=75, stat_string=mmc_rx_tcp_gd_octets (len 21) [ 479.652646] STMMAC_MMC_STATS i=76, stat_string=mmc_rx_tcp_err_octets (len 22) [ 479.659901] STMMAC_MMC_STATS i=77, stat_string=mmc_rx_icmp_gd_octets (len 22) [ 479.667117] STMMAC_MMC_STATS i=78, stat_string=mmc_rx_icmp_err_octets (len 23) [ 479.674434] STMMAC_MMC_STATS i=79, stat_string=mmc_tx_fpe_fragment_cntr (len 25) [ 479.682463] STMMAC_MMC_STATS i=80, stat_string=mmc_tx_hold_req_cntr (len 21) [ 479.689589] STMMAC_MMC_STATS i=81, stat_string=mmc_rx_packet_assembly_err_cntr (len 32) [ 479.698065] STMMAC_MMC_STATS i=82, stat_string=mmc_rx_packet_smd_err_cntr (len 27) [ 479.705703] STMMAC_MMC_STATS i=83, stat_string=mmc_rx_packet_assembly_ok_cntr (len 31) [ 479.714707] STMMAC_MMC_STATS i=84, stat_string=mmc_rx_fpe_fragment_cntr (len 25) [ 479.722188] STMMAC_STATS i=0, stat_string=tx_underflow (len 13) [ 479.728183] STMMAC_STATS i=1, stat_string=tx_carrier (len 11) [ 479.734050] STMMAC_STATS i=2, stat_string=tx_losscarrier (len 15) [ 479.740197] STMMAC_STATS i=3, stat_string=vlan_tag (len 9) [ 479.746215] STMMAC_STATS i=4, stat_string=tx_deferred (len 12) [ 479.752119] STMMAC_STATS i=5, stat_string=tx_vlan (len 8) [ 479.757594] STMMAC_STATS i=6, stat_string=tx_jabber (len 10) [ 479.763319] STMMAC_STATS i=7, stat_string=tx_frame_flushed (len 17) [ 479.769629] STMMAC_STATS i=8, stat_string=tx_payload_error (len 17) [ 479.776479] STMMAC_STATS i=9, stat_string=tx_ip_header_error (len 19) [ 479.783392] STMMAC_STATS i=10, stat_string=rx_desc (len 8) [ 479.788970] STMMAC_STATS i=11, stat_string=sa_filter_fail (len 15) [ 479.795214] STMMAC_STATS i=12, stat_string=overflow_error (len 15) [ 479.801703] STMMAC_STATS i=13, stat_string=ipc_csum_error (len 15) [ 479.807983] STMMAC_STATS i=14, stat_string=rx_collision (len 13) [ 479.814460] STMMAC_STATS i=15, stat_string=rx_crc_errors (len 14) [ 479.820938] STMMAC_STATS i=16, stat_string=dribbling_bit (len 14) [ 479.827136] STMMAC_STATS i=17, stat_string=rx_length (len 10) [ 479.833604] STMMAC_STATS i=18, stat_string=rx_mii (len 7) [ 479.839619] STMMAC_STATS i=19, stat_string=rx_multicast (len 13) [ 479.846480] STMMAC_STATS i=20, stat_string=rx_gmac_overflow (len 17) [ 479.852913] STMMAC_STATS i=21, stat_string=rx_watchdog (len 12) [ 479.859240] STMMAC_STATS i=22, stat_string=da_rx_filter_fail (len 18) [ 479.865760] STMMAC_STATS i=23, stat_string=sa_rx_filter_fail (len 18) [ 479.872687] STMMAC_STATS i=24, stat_string=rx_missed_cntr (len 15) [ 479.879075] STMMAC_STATS i=25, stat_string=rx_overflow_cntr (len 17) [ 479.885573] STMMAC_STATS i=26, stat_string=rx_vlan (len 8) [ 479.891122] STMMAC_STATS i=27, stat_string=rx_split_hdr_pkt_n (len 19) [ 479.897705] STMMAC_STATS i=28, stat_string=tx_undeflow_irq (len 16) [ 479.904499] STMMAC_STATS i=29, stat_string=tx_process_stopped_irq (len 23) [ 479.911457] STMMAC_STATS i=30, stat_string=tx_jabber_irq (len 14) [ 479.917897] STMMAC_STATS i=31, stat_string=rx_overflow_irq (len 16) [ 479.924268] STMMAC_STATS i=32, stat_string=rx_buf_unav_irq (len 16) [ 479.930722] STMMAC_STATS i=33, stat_string=rx_process_stopped_irq (len 23) [ 479.938108] STMMAC_STATS i=34, stat_string=rx_watchdog_irq (len 16) [ 479.944518] STMMAC_STATS i=35, stat_string=tx_early_irq (len 13) [ 479.950895] STMMAC_STATS i=36, stat_string=fatal_bus_error_irq (len 20) [ 479.957622] STMMAC_STATS i=37, stat_string=rx_early_irq (len 13) [ 479.964082] STMMAC_STATS i=38, stat_string=threshold (len 10) [ 479.970509] STMMAC_STATS i=39, stat_string=tx_pkt_n (len 9) [ 479.976159] STMMAC_STATS i=40, stat_string=rx_pkt_n (len 9) [ 479.981799] STMMAC_STATS i=41, stat_string=normal_irq_n (len 13) [ 479.987917] STMMAC_STATS i=42, stat_string=rx_normal_irq_n (len 16) [ 479.994283] STMMAC_STATS i=43, stat_string=napi_poll (len 10) [ 480.000395] STMMAC_STATS i=44, stat_string=tx_normal_irq_n (len 16) [ 480.006807] STMMAC_STATS i=45, stat_string=tx_clean (len 9) [ 480.012865] STMMAC_STATS i=46, stat_string=tx_set_ic_bit (len 14) [ 480.019043] STMMAC_STATS i=47, stat_string=irq_receive_pmt_irq_n (len 22) [ 480.026155] STMMAC_STATS i=48, stat_string=mmc_tx_irq_n (len 13) [ 480.032833] STMMAC_STATS i=49, stat_string=mmc_rx_irq_n (len 13) [ 480.038994] STMMAC_STATS i=50, stat_string=mmc_rx_csum_offload_irq_n (len 26) [ 480.046500] STMMAC_STATS i=51, stat_string=irq_tx_path_in_lpi_mode_n (len 26) [ 480.053710] STMMAC_STATS i=52, stat_string=irq_tx_path_exit_lpi_mode_n (len 28) [ 480.061074] STMMAC_STATS i=53, stat_string=irq_rx_path_in_lpi_mode_n (len 26) [ 480.068830] STMMAC_STATS i=54, stat_string=irq_rx_path_exit_lpi_mode_n (len 28) [ 480.076913] STMMAC_STATS i=55, stat_string=phy_eee_wakeup_error_n (len 23) [ 480.083906] STMMAC_STATS i=56, stat_string=ip_hdr_err (len 11) [ 480.089803] STMMAC_STATS i=57, stat_string=ip_payload_err (len 15) [ 480.096634] STMMAC_STATS i=58, stat_string=ip_csum_bypassed (len 17) [ 480.103087] STMMAC_STATS i=59, stat_string=ipv4_pkt_rcvd (len 14) [ 480.109499] STMMAC_STATS i=60, stat_string=ipv6_pkt_rcvd (len 14) [ 480.115679] STMMAC_STATS i=61, stat_string=no_ptp_rx_msg_type_ext (len 23) [ 480.123066] STMMAC_STATS i=62, stat_string=ptp_rx_msg_type_sync (len 21) [ 480.130471] STMMAC_STATS i=63, stat_string=ptp_rx_msg_type_follow_up (len 26) [ 480.137685] STMMAC_STATS i=64, stat_string=ptp_rx_msg_type_delay_req (len 26) [ 480.145088] STMMAC_STATS i=65, stat_string=ptp_rx_msg_type_delay_resp (len 27) [ 480.152385] STMMAC_STATS i=66, stat_string=ptp_rx_msg_type_pdelay_req (len 27) [ 480.160200] STMMAC_STATS i=67, stat_string=ptp_rx_msg_type_pdelay_resp (len 28) [ 480.167581] STMMAC_STATS i=68, stat_string=ptp_rx_msg_type_pdelay_follow_u (len 32) [ 480.175469] STMMAC_STATS i=69, stat_string=ptp_rx_msg_type_announce (len 25) [ 480.182632] STMMAC_STATS i=70, stat_string=ptp_rx_msg_type_management (len 27) [ 480.190369] STMMAC_STATS i=71, stat_string=ptp_rx_msg_pkt_reserved_type (len 29) [ 480.197842] STMMAC_STATS i=72, stat_string=ptp_frame_type (len 15) [ 480.204065] STMMAC_STATS i=73, stat_string=ptp_ver (len 8) [ 480.209614] STMMAC_STATS i=74, stat_string=timestamp_dropped (len 18) [ 480.216092] STMMAC_STATS i=75, stat_string=av_pkt_rcvd (len 12) [ 480.222731] STMMAC_STATS i=76, stat_string=av_tagged_pkt_rcvd (len 19) [ 480.229353] STMMAC_STATS i=77, stat_string=vlan_tag_priority_val (len 22) [ 480.236491] STMMAC_STATS i=78, stat_string=l3_filter_match (len 16) [ 480.242895] STMMAC_STATS i=79, stat_string=l4_filter_match (len 16) [ 480.249616] STMMAC_STATS i=80, stat_string=l3_l4_filter_no_match (len 22) [ 480.256931] STMMAC_STATS i=81, stat_string=irq_pcs_ane_n (len 14) [ 480.264320] STMMAC_STATS i=82, stat_string=irq_pcs_link_n (len 15) [ 480.270901] STMMAC_STATS i=83, stat_string=irq_rgmii_n (len 12) [ 480.276921] STMMAC_STATS i=84, stat_string=mtl_tx_status_fifo_full (len 24) [ 480.283973] STMMAC_STATS i=85, stat_string=mtl_tx_fifo_not_empty (len 22) [ 480.291395] STMMAC_STATS i=86, stat_string=mmtl_fifo_ctrl (len 15) [ 480.298225] STMMAC_STATS i=87, stat_string=mtl_tx_fifo_read_ctrl_write (len 28) [ 480.305608] STMMAC_STATS i=88, stat_string=mtl_tx_fifo_read_ctrl_wait (len 27) [ 480.313299] STMMAC_STATS i=89, stat_string=mtl_tx_fifo_read_ctrl_read (len 27) [ 480.320641] STMMAC_STATS i=90, stat_string=mtl_tx_fifo_read_ctrl_idle (len 27) [ 480.328459] STMMAC_STATS i=91, stat_string=mac_tx_in_pause (len 16) [ 480.334810] STMMAC_STATS i=92, stat_string=mac_tx_frame_ctrl_xfer (len 23) [ 480.341777] STMMAC_STATS i=93, stat_string=mac_tx_frame_ctrl_idle (len 23) [ 480.349311] STMMAC_STATS i=94, stat_string=mac_tx_frame_ctrl_wait (len 23) [ 480.356688] STMMAC_STATS i=95, stat_string=mac_tx_frame_ctrl_pause (len 24) [ 480.363728] STMMAC_STATS i=96, stat_string=mac_gmii_tx_proto_engine (len 25) [ 480.370828] STMMAC_STATS i=97, stat_string=mtl_rx_fifo_fill_level_full (len 28) [ 480.378256] STMMAC_STATS i=98, stat_string=mtl_rx_fifo_fill_above_thresh (len 30) [ 480.386412] STMMAC_STATS i=99, stat_string=mtl_rx_fifo_fill_below_thresh (len 30) [ 480.393993] STMMAC_STATS i=100, stat_string=mtl_rx_fifo_fill_level_empty (len 29) [ 480.402512] STMMAC_STATS i=101, stat_string=mtl_rx_fifo_read_ctrl_flush (len 28) [ 480.410014] STMMAC_STATS i=102, stat_string=mtl_rx_fifo_read_ctrl_read_data (len 32) [ 480.418388] STMMAC_STATS i=103, stat_string=mtl_rx_fifo_read_ctrl_status (len 29) [ 480.425965] STMMAC_STATS i=104, stat_string=mtl_rx_fifo_read_ctrl_idle (len 27) [ 480.433324] STMMAC_STATS i=105, stat_string=mtl_rx_fifo_ctrl_active (len 24) [ 480.440431] STMMAC_STATS i=106, stat_string=mac_rx_frame_ctrl_fifo (len 23) [ 480.448023] STMMAC_STATS i=107, stat_string=mac_gmii_rx_proto_engine (len 25) [ 480.455226] STMMAC_STATS i=108, stat_string=tx_tso_frames (len 14) [ 480.461458] STMMAC_STATS i=109, stat_string=tx_tso_nfrags (len 14) [ 480.467714] STMMAC_STATS i=110, stat_string=mtl_est_cgce (len 13) [ 480.473848] STMMAC_STATS i=111, stat_string=mtl_est_hlbs (len 13) [ 480.480489] STMMAC_STATS i=112, stat_string=mtl_est_hlbf (len 13) [ 480.486665] STMMAC_STATS i=113, stat_string=mtl_est_btre (len 13) [ 480.493206] STMMAC_STATS i=114, stat_string=mtl_est_btrlm (len 14) > > No, since strscpy does the job already. Also I could not find ethtool_puts: > > where is it defined? Or do you mean ethtool_put_stat, which is inappropriate to > > use here since it requires a skb parameter? > > https://patchwork.kernel.org/project/netdevbpf/patch/20231102-ethtool_puts_impl-v4-3-14e1e9278496@google.com/ > > Maybe check with Justin when we will resend that patch. Thanks for the link to ethtool_puts patch: Changing to use ethtool_puts in stmmac should be in a separate patch, and not related here. > > Andrew Ray
diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_ethtool.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_ethtool.c index f628411ae4ae..127cde8f976e 100644 --- a/drivers/net/ethernet/stmicro/stmmac/stmmac_ethtool.c +++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_ethtool.c @@ -749,23 +749,24 @@ static void stmmac_get_strings(struct net_device *dev, u32 stringset, u8 *data) if (!stmmac_safety_feat_dump(priv, &priv->sstats, i, NULL, &desc)) { - memcpy(p, desc, ETH_GSTRING_LEN); + strscpy(p, desc, ETH_GSTRING_LEN); p += ETH_GSTRING_LEN; } } } if (priv->dma_cap.rmon) for (i = 0; i < STMMAC_MMC_STATS_LEN; i++) { - memcpy(p, stmmac_mmc[i].stat_string, - ETH_GSTRING_LEN); + strscpy(p, stmmac_mmc[i].stat_string, + ETH_GSTRING_LEN); p += ETH_GSTRING_LEN; } for (i = 0; i < STMMAC_STATS_LEN; i++) { - memcpy(p, stmmac_gstrings_stats[i].stat_string, ETH_GSTRING_LEN); + strscpy(p, stmmac_gstrings_stats[i].stat_string, + ETH_GSTRING_LEN); p += ETH_GSTRING_LEN; } for (i = 0; i < STMMAC_QSTATS; i++) { - memcpy(p, stmmac_qstats_string[i], ETH_GSTRING_LEN); + strscpy(p, stmmac_qstats_string[i], ETH_GSTRING_LEN); p += ETH_GSTRING_LEN; } stmmac_get_qstats_string(priv, p);
CONFIG_KASAN detected out-of-bounds read via memcpy in stmmac_get_strings. The fix is to change memcpy to strscpy. Tested: <machine_obfuscated>:~# ethtool -i <interface_obfuscated> driver: st_gmac <machine_obfuscated>:~# ethtool -S <interface_obfuscated> NIC statistics: ATPES: 0 TPES: 0 RDPES: 0 MPES: 0 MTSPES: 0 ARPES: 0 CWPES: 0 ASRPES: 0 TTES: 0 RTES: 0 CTES: 0 ATES: 0 PTES: 0 T125ES: 0 R125ES: 0 RVCTES: 0 MSTTES: 0 SLVTES: 0 ATITES: 0 ARITES: 0 FSMPES: 0 TXCES: 0 TXAMS: 0 TXUES: 0 RXCES: 0 RXAMS: 0 RXUES: 0 ECES: 0 EAMS: 0 EUES: 0 RPCES: 0 RPAMS: 0 RPUES: 0 TCES: 0 TAMS: 0 TUES: 0 mmc_tx_octetcount_gb: 11612 mmc_tx_framecount_gb: 100 mmc_tx_broadcastframe_g: 0 mmc_tx_multicastframe_g: 42 mmc_tx_64_octets_gb: 0 mmc_tx_65_to_127_octets_gb: 62 mmc_tx_128_to_255_octets_gb: 38 mmc_tx_256_to_511_octets_gb: 0 mmc_tx_512_to_1023_octets_gb: 0 mmc_tx_1024_to_max_octets_gb: 0 mmc_tx_unicast_gb: 58 mmc_tx_multicast_gb: 42 mmc_tx_broadcast_gb: 0 mmc_tx_underflow_error: 0 mmc_tx_singlecol_g: 0 mmc_tx_multicol_g: 0 mmc_tx_deferred: 0 mmc_tx_latecol: 0 mmc_tx_exesscol: 0 mmc_tx_carrier_error: 0 mmc_tx_octetcount_g: 11612 mmc_tx_framecount_g: 100 mmc_tx_excessdef: 0 mmc_tx_pause_frame: 0 mmc_tx_vlan_frame_g: 0 mmc_rx_framecount_gb: 64 mmc_rx_octetcount_gb: 30235 mmc_rx_octetcount_g: 30235 mmc_rx_broadcastframe_g: 0 mmc_rx_multicastframe_g: 0 mmc_rx_crc_error: 0 mmc_rx_align_error: 0 mmc_rx_run_error: 0 mmc_rx_jabber_error: 0 mmc_rx_undersize_g: 0 mmc_rx_oversize_g: 0 mmc_rx_64_octets_gb: 0 mmc_rx_65_to_127_octets_gb: 9 mmc_rx_128_to_255_octets_gb: 22 mmc_rx_256_to_511_octets_gb: 21 mmc_rx_512_to_1023_octets_gb: 2 mmc_rx_1024_to_max_octets_gb: 10 mmc_rx_unicast_g: 64 mmc_rx_length_error: 0 mmc_rx_autofrangetype: 0 mmc_rx_pause_frames: 0 mmc_rx_fifo_overflow: 0 mmc_rx_vlan_frames_gb: 0 mmc_rx_watchdog_error: 0 mmc_rx_ipc_intr_mask: 0 mmc_rx_ipc_intr: 0 mmc_rx_ipv4_gd: 0 mmc_rx_ipv4_hderr: 0 mmc_rx_ipv4_nopay: 0 mmc_rx_ipv4_frag: 0 mmc_rx_ipv4_udsbl: 0 mmc_rx_ipv4_gd_octets: 0 mmc_rx_ipv4_hderr_octets: 0 mmc_rx_ipv4_nopay_octets: 0 mmc_rx_ipv4_frag_octets: 0 mmc_rx_ipv4_udsbl_octets: 0 mmc_rx_ipv6_gd_octets: 0 mmc_rx_ipv6_hderr_octets: 0 mmc_rx_ipv6_nopay_octets: 0 mmc_rx_ipv6_gd: 0 mmc_rx_ipv6_hderr: 0 mmc_rx_ipv6_nopay: 0 mmc_rx_udp_gd: 0 mmc_rx_udp_err: 0 mmc_rx_tcp_gd: 0 mmc_rx_tcp_err: 0 mmc_rx_icmp_gd: 0 mmc_rx_icmp_err: 0 mmc_rx_udp_gd_octets: 0 mmc_rx_udp_err_octets: 0 mmc_rx_tcp_gd_octets: 0 mmc_rx_tcp_err_octets: 0 mmc_rx_icmp_gd_octets: 0 mmc_rx_icmp_err_octets: 0 mmc_tx_fpe_fragment_cntr: 0 mmc_tx_hold_req_cntr: 0 mmc_rx_packet_assembly_err_cntr: 0 mmc_rx_packet_smd_err_cntr: 0 mmc_rx_packet_assembly_ok_cntr: 0 mmc_rx_fpe_fragment_cntr: 0 tx_underflow: 0 tx_carrier: 0 tx_losscarrier: 0 vlan_tag: 0 tx_deferred: 0 tx_vlan: 0 tx_jabber: 0 tx_frame_flushed: 0 tx_payload_error: 0 tx_ip_header_error: 0 rx_desc: 0 sa_filter_fail: 0 overflow_error: 0 ipc_csum_error: 0 rx_collision: 0 rx_crc_errors: 0 dribbling_bit: 0 rx_length: 0 rx_mii: 0 rx_multicast: 0 rx_gmac_overflow: 0 rx_watchdog: 0 da_rx_filter_fail: 0 sa_rx_filter_fail: 0 rx_missed_cntr: 0 rx_overflow_cntr: 0 rx_vlan: 0 rx_split_hdr_pkt_n: 0 tx_undeflow_irq: 0 tx_process_stopped_irq: 0 tx_jabber_irq: 0 rx_overflow_irq: 0 rx_buf_unav_irq: 0 rx_process_stopped_irq: 0 rx_watchdog_irq: 0 tx_early_irq: 0 fatal_bus_error_irq: 0 rx_early_irq: 0 threshold: 64 tx_pkt_n: 100 rx_pkt_n: 64 normal_irq_n: 62 rx_normal_irq_n: 58 napi_poll: 215 tx_normal_irq_n: 4 tx_clean: 157 tx_set_ic_bit: 4 irq_receive_pmt_irq_n: 0 mmc_tx_irq_n: 0 mmc_rx_irq_n: 0 mmc_rx_csum_offload_irq_n: 0 irq_tx_path_in_lpi_mode_n: 0 irq_tx_path_exit_lpi_mode_n: 0 irq_rx_path_in_lpi_mode_n: 0 irq_rx_path_exit_lpi_mode_n: 0 phy_eee_wakeup_error_n: 0 ip_hdr_err: 0 ip_payload_err: 0 ip_csum_bypassed: 0 ipv4_pkt_rcvd: 0 ipv6_pkt_rcvd: 64 no_ptp_rx_msg_type_ext: 64 ptp_rx_msg_type_sync: 0 ptp_rx_msg_type_follow_up: 0 ptp_rx_msg_type_delay_req: 0 ptp_rx_msg_type_delay_resp: 0 ptp_rx_msg_type_pdelay_req: 0 ptp_rx_msg_type_pdelay_resp: 0 ptp_rx_msg_type_pdelay_follow_up: 0 ptp_rx_msg_type_announce: 0 ptp_rx_msg_type_management: 0 ptp_rx_msg_pkt_reserved_type: 0 ptp_frame_type: 0 ptp_ver: 0 timestamp_dropped: 0 av_pkt_rcvd: 0 av_tagged_pkt_rcvd: 0 vlan_tag_priority_val: 0 l3_filter_match: 0 l4_filter_match: 0 l3_l4_filter_no_match: 0 irq_pcs_ane_n: 0 irq_pcs_link_n: 0 irq_rgmii_n: 0 mtl_tx_status_fifo_full: 0 mtl_tx_fifo_not_empty: 0 mmtl_fifo_ctrl: 0 mtl_tx_fifo_read_ctrl_write: 0 mtl_tx_fifo_read_ctrl_wait: 0 mtl_tx_fifo_read_ctrl_read: 0 mtl_tx_fifo_read_ctrl_idle: 0 mac_tx_in_pause: 0 mac_tx_frame_ctrl_xfer: 0 mac_tx_frame_ctrl_idle: 0 mac_tx_frame_ctrl_wait: 0 mac_tx_frame_ctrl_pause: 0 mac_gmii_tx_proto_engine: 0 mtl_rx_fifo_fill_level_full: 0 mtl_rx_fifo_fill_above_thresh: 0 mtl_rx_fifo_fill_below_thresh: 0 mtl_rx_fifo_fill_level_empty: 0 mtl_rx_fifo_read_ctrl_flush: 0 mtl_rx_fifo_read_ctrl_read_data: 0 mtl_rx_fifo_read_ctrl_status: 0 mtl_rx_fifo_read_ctrl_idle: 0 mtl_rx_fifo_ctrl_active: 0 mac_rx_frame_ctrl_fifo: 0 mac_gmii_rx_proto_engine: 0 tx_tso_frames: 0 tx_tso_nfrags: 0 mtl_est_cgce: 0 mtl_est_hlbs: 0 mtl_est_hlbf: 0 mtl_est_btre: 0 mtl_est_btrlm: 0 q0_tx_pkt_n: 100 q0_tx_irq_n: 4 q0_rx_pkt_n: 64 q0_rx_irq_n: 58 Signed-off-by: Ray Zhang <sgzhang@google.com> --- drivers/net/ethernet/stmicro/stmmac/stmmac_ethtool.c | 11 ++++++----- 1 file changed, 6 insertions(+), 5 deletions(-)