diff mbox series

[net,1/2] ethtool: cmis_cdb: use correct rpl size in ethtool_cmis_module_poll()

Message ID 20250402183123.321036-2-michael.chan@broadcom.com (mailing list archive)
State Changes Requested
Delegated to: Netdev Maintainers
Headers show
Series ethtool: cmis fixes | expand

Checks

Context Check Description
netdev/series_format success Posting correctly formatted
netdev/tree_selection success Clearly marked for net
netdev/ynl success Generated files up to date; no warnings/errors; no diff in generated;
netdev/fixes_present success Fixes tag present in non-next series
netdev/header_inline success No static functions without inline keyword in header files
netdev/build_32bit success Errors and warnings before: 0 this patch: 0
netdev/build_tools success No tools touched, skip
netdev/cc_maintainers fail 1 blamed authors not CCed: petrm@nvidia.com; 1 maintainers not CCed: petrm@nvidia.com
netdev/build_clang success Errors and warnings before: 0 this patch: 0
netdev/verify_signedoff success Signed-off-by tag matches author and committer
netdev/deprecated_api success None detected
netdev/check_selftest success No net selftest shell script
netdev/verify_fixes fail Problems with Fixes tag: 1
netdev/build_allmodconfig_warn success Errors and warnings before: 0 this patch: 0
netdev/checkpatch warning WARNING: Please use correct Fixes: style 'Fixes: <12+ chars of sha1> ("<title line>")' - ie: 'Fixes: a39c84d79625 ("ethtool: cmis_cdb: Add a layer for supporting CDB commands")'
netdev/build_clang_rust success No Rust files in patch. Skipping build
netdev/kdoc success Errors and warnings before: 0 this patch: 0
netdev/source_inline success Was 0 now: 0
netdev/contest success net-next-2025-04-04--00-00 (tests: 911)

Commit Message

Michael Chan April 2, 2025, 6:31 p.m. UTC 
From: Damodharam Ammepalli <damodharam.ammepalli@broadcom.com>

rpl is passed as a pointer to ethtool_cmis_module_poll(), so the correct
size of rpl is sizeof(*rpl) which should be just 1 byte.  Using the
pointer size instead can cause stack corruption:

Kernel panic - not syncing: stack-protector: Kernel stack is corrupted in: ethtool_cmis_wait_for_cond+0xf4/0x100
CPU: 72 UID: 0 PID: 4440 Comm: kworker/72:2 Kdump: loaded Tainted: G           OE      6.11.0 #24
Tainted: [O]=OOT_MODULE, [E]=UNSIGNED_MODULE
Hardware name: Dell Inc. PowerEdge R760/04GWWM, BIOS 1.6.6 09/20/2023
Workqueue: events module_flash_fw_work
Call Trace:
 <TASK>
 panic+0x339/0x360
 ? ethtool_cmis_wait_for_cond+0xf4/0x100
 ? __pfx_status_success+0x10/0x10
 ? __pfx_status_fail+0x10/0x10
 __stack_chk_fail+0x10/0x10
 ethtool_cmis_wait_for_cond+0xf4/0x100
 ethtool_cmis_cdb_execute_cmd+0x1fc/0x330
 ? __pfx_status_fail+0x10/0x10
 cmis_cdb_module_features_get+0x6d/0xd0
 ethtool_cmis_cdb_init+0x8a/0xd0
 ethtool_cmis_fw_update+0x46/0x1d0
 module_flash_fw_work+0x17/0xa0
 process_one_work+0x179/0x390
 worker_thread+0x239/0x340
 ? __pfx_worker_thread+0x10/0x10
 kthread+0xcc/0x100
 ? __pfx_kthread+0x10/0x10
 ret_from_fork+0x2d/0x50
 ? __pfx_kthread+0x10/0x10
 ret_from_fork_asm+0x1a/0x30
 </TASK>

Fixes: a39c84d79625 ("ethtool: cmis_cdb: Add a layer for supporting CDB commands)
Reviewed-by: Andy Gospodarek <andrew.gospodarek@broadcom.com>
Signed-off-by: Damodharam Ammepalli <damodharam.ammepalli@broadcom.com>
Signed-off-by: Michael Chan <michael.chan@broadcom.com>
---
 net/ethtool/cmis_cdb.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

Comments

Simon Horman April 3, 2025, 9:02 a.m. UTC | #1 
On Wed, Apr 02, 2025 at 11:31:22AM -0700, Michael Chan wrote:
> From: Damodharam Ammepalli <damodharam.ammepalli@broadcom.com>
> 
> rpl is passed as a pointer to ethtool_cmis_module_poll(), so the correct
> size of rpl is sizeof(*rpl) which should be just 1 byte.  Using the
> pointer size instead can cause stack corruption:
> 
> Kernel panic - not syncing: stack-protector: Kernel stack is corrupted in: ethtool_cmis_wait_for_cond+0xf4/0x100
> CPU: 72 UID: 0 PID: 4440 Comm: kworker/72:2 Kdump: loaded Tainted: G           OE      6.11.0 #24
> Tainted: [O]=OOT_MODULE, [E]=UNSIGNED_MODULE
> Hardware name: Dell Inc. PowerEdge R760/04GWWM, BIOS 1.6.6 09/20/2023
> Workqueue: events module_flash_fw_work
> Call Trace:
>  <TASK>
>  panic+0x339/0x360
>  ? ethtool_cmis_wait_for_cond+0xf4/0x100
>  ? __pfx_status_success+0x10/0x10
>  ? __pfx_status_fail+0x10/0x10
>  __stack_chk_fail+0x10/0x10
>  ethtool_cmis_wait_for_cond+0xf4/0x100
>  ethtool_cmis_cdb_execute_cmd+0x1fc/0x330
>  ? __pfx_status_fail+0x10/0x10
>  cmis_cdb_module_features_get+0x6d/0xd0
>  ethtool_cmis_cdb_init+0x8a/0xd0
>  ethtool_cmis_fw_update+0x46/0x1d0
>  module_flash_fw_work+0x17/0xa0
>  process_one_work+0x179/0x390
>  worker_thread+0x239/0x340
>  ? __pfx_worker_thread+0x10/0x10
>  kthread+0xcc/0x100
>  ? __pfx_kthread+0x10/0x10
>  ret_from_fork+0x2d/0x50
>  ? __pfx_kthread+0x10/0x10
>  ret_from_fork_asm+0x1a/0x30
>  </TASK>
> 
> Fixes: a39c84d79625 ("ethtool: cmis_cdb: Add a layer for supporting CDB commands)
> Reviewed-by: Andy Gospodarek <andrew.gospodarek@broadcom.com>
> Signed-off-by: Damodharam Ammepalli <damodharam.ammepalli@broadcom.com>
> Signed-off-by: Michael Chan <michael.chan@broadcom.com>

Hi Damodharam, all,

I don't think there is any need to resend for this, but I think
there is a '"' missing towards the end of the Fixes tag above.
That is, I think it should look like this:

Fixes: a39c84d79625 ("ethtool: cmis_cdb: Add a layer for supporting CDB commands")

Other than the nit above this looks good to me.

Reviewed-by: Simon Horman <horms@kernel.org>
Ido Schimmel April 3, 2025, 3:06 p.m. UTC | #2 
On Wed, Apr 02, 2025 at 11:31:22AM -0700, Michael Chan wrote:
> From: Damodharam Ammepalli <damodharam.ammepalli@broadcom.com>
> 
> rpl is passed as a pointer to ethtool_cmis_module_poll(), so the correct
> size of rpl is sizeof(*rpl) which should be just 1 byte.  Using the
> pointer size instead can cause stack corruption:
> 
> Kernel panic - not syncing: stack-protector: Kernel stack is corrupted in: ethtool_cmis_wait_for_cond+0xf4/0x100
> CPU: 72 UID: 0 PID: 4440 Comm: kworker/72:2 Kdump: loaded Tainted: G           OE      6.11.0 #24
> Tainted: [O]=OOT_MODULE, [E]=UNSIGNED_MODULE
> Hardware name: Dell Inc. PowerEdge R760/04GWWM, BIOS 1.6.6 09/20/2023
> Workqueue: events module_flash_fw_work
> Call Trace:
>  <TASK>
>  panic+0x339/0x360
>  ? ethtool_cmis_wait_for_cond+0xf4/0x100
>  ? __pfx_status_success+0x10/0x10
>  ? __pfx_status_fail+0x10/0x10
>  __stack_chk_fail+0x10/0x10
>  ethtool_cmis_wait_for_cond+0xf4/0x100
>  ethtool_cmis_cdb_execute_cmd+0x1fc/0x330
>  ? __pfx_status_fail+0x10/0x10
>  cmis_cdb_module_features_get+0x6d/0xd0
>  ethtool_cmis_cdb_init+0x8a/0xd0
>  ethtool_cmis_fw_update+0x46/0x1d0
>  module_flash_fw_work+0x17/0xa0
>  process_one_work+0x179/0x390
>  worker_thread+0x239/0x340
>  ? __pfx_worker_thread+0x10/0x10
>  kthread+0xcc/0x100
>  ? __pfx_kthread+0x10/0x10
>  ret_from_fork+0x2d/0x50
>  ? __pfx_kthread+0x10/0x10
>  ret_from_fork_asm+0x1a/0x30
>  </TASK>
> 
> Fixes: a39c84d79625 ("ethtool: cmis_cdb: Add a layer for supporting CDB commands)
> Reviewed-by: Andy Gospodarek <andrew.gospodarek@broadcom.com>
> Signed-off-by: Damodharam Ammepalli <damodharam.ammepalli@broadcom.com>
> Signed-off-by: Michael Chan <michael.chan@broadcom.com>

Reviewed-by: Ido Schimmel <idosch@nvidia.com>
diff mbox series

Patch

diff --git a/net/ethtool/cmis_cdb.c b/net/ethtool/cmis_cdb.c
index d159dc121bde..dba3aa909a95 100644
--- a/net/ethtool/cmis_cdb.c
+++ b/net/ethtool/cmis_cdb.c
@@ -363,7 +363,7 @@  ethtool_cmis_module_poll(struct net_device *dev,
 	struct netlink_ext_ack extack = {};
 	int err;
 
-	ethtool_cmis_page_init(&page_data, 0, offset, sizeof(rpl));
+	ethtool_cmis_page_init(&page_data, 0, offset, sizeof(*rpl));
 	page_data.data = (u8 *)rpl;
 
 	err = ops->get_module_eeprom_by_page(dev, &page_data, &extack);