mirror of
https://github.com/torvalds/linux.git
synced 2026-09-14 16:10:02 +02:00
11c057d234
The MCIA register can return up to 32 dwords (128 bytes) when the device
advertises the mcia_32dwords capability, but struct
mlx5_ifc_mcia_reg_bits only defines dword_0..11, leaving room for just
12 dwords (48 bytes) of data.
mlx5_query_mcia() clamps the read size to mlx5_mcia_max_bytes() and then
memcpy()s that many bytes out of the register, potentially reading past
the end of the 'out' buffer. On kernels built with FORTIFY_SOURCE this
is caught as a buffer overflow while reading the module EEPROM via
ethtool:
detected buffer overflow in memcpy
kernel BUG at lib/string_helpers.c:1048!
RIP: 0010:fortify_panic+0x13/0x20
Call Trace:
mlx5_query_mcia.isra.0+0x200/0x210 [mlx5_core]
mlx5_query_module_eeprom_by_page+0x4a/0xa0 [mlx5_core]
mlx5e_get_module_eeprom_by_page+0xbb/0x120 [mlx5_core]
eeprom_prepare_data+0xf3/0x170
ethnl_default_doit+0xf1/0x3b0
Extend the mcia_reg layout to 32 dwords.
Fixes:
|
||
|---|---|---|
| .. | ||
| cq.h | ||
| device.h | ||
| doorbell.h | ||
| driver.h | ||
| eq.h | ||
| eswitch.h | ||
| fs_helpers.h | ||
| fs.h | ||
| lag.h | ||
| macsec.h | ||
| mlx5_ifc_fpga.h | ||
| mlx5_ifc_vdpa.h | ||
| mlx5_ifc.h | ||
| mpfs.h | ||
| port.h | ||
| qp.h | ||
| rsc_dump.h | ||
| transobj.h | ||
| vport.h | ||