aboutsummaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorIdo Schimmel <idosch@nvidia.com>2021-09-14 14:27:35 +0300
committerMichal Kubecek <mkubecek@suse.cz>2021-09-15 18:22:17 +0200
commit7e153a7da4f1631e2e1bef023ff6db6e96653059 (patch)
tree053365f95da92d9c154e4f88c31f89b27a8ab01a
parent769a50e66b11e5b17b1521a3a63648de89f020fb (diff)
downloadethtool-7e153a7da4f1631e2e1bef023ff6db6e96653059.tar.gz
cmis: Fix invalid memory access in IOCTL path
Page 01h is an optional page that is not available for flat memory modules. Trying to blindly access it results in the following report from AddressSanitizer [1]. Instead, pass the base address of the Lower Memory. This results in wrong information being parsed, but this never worked correctly since CMIS support first appeared in cited commit. The information will be parsed correctly in a follow-up submission that reworks the EEPROM parsing code to use a memory map with pointers to individual pages instead of passing one large buffer. [1] ==968785==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x6120000001d4 at pc 0x0000004806ee bp 0x7ffefbc977a0 sp 0x7ffefbc97798 READ of size 1 at 0x6120000001d4 thread T0 #0 0x4806ed in cmis_print_smf_cbl_len cmis.c:127 #1 0x48113e in cmis_show_link_len_from_page cmis.c:279 #2 0x4811e3 in cmis_show_link_len cmis.c:300 #3 0x481358 in qsfp_dd_show_all cmis.c:336 #4 0x47d190 in sff8636_show_all qsfp.c:861 #5 0x42130b in do_getmodule ethtool.c:4908 #6 0x42a38a in main ethtool.c:6383 #7 0x7f11db6c51e1 in __libc_start_main (/lib64/libc.so.6+0x281e1) #8 0x40258d in _start (ethtool+0x40258d) Address 0x6120000001d4 is a wild pointer. SUMMARY: AddressSanitizer: heap-buffer-overflow cmis.c:127 in cmis_print_smf_cbl_len Fixes: 88ca347ef35a ("Add QSFP-DD support"). Signed-off-by: Ido Schimmel <idosch@nvidia.com>
-rw-r--r--cmis.c2
1 files changed, 1 insertions, 1 deletions
diff --git a/cmis.c b/cmis.c
index 361b721..1a91e79 100644
--- a/cmis.c
+++ b/cmis.c
@@ -297,7 +297,7 @@ static void cmis_show_link_len_from_page(const __u8 *page_one_data)
*/
static void cmis_show_link_len(const __u8 *id)
{
- cmis_show_link_len_from_page(id + PAG01H_UPPER_OFFSET);
+ cmis_show_link_len_from_page(id);
}
/**