Commit da328711 authored by Alexander Lobakin's avatar Alexander Lobakin Committed by David S. Miller

net: qed: fix buffer overflow on ethtool -d

When generating debug dump, driver firstly collects all data in binary
form, and then performs per-feature formatting to human-readable if it
is supported.

For ethtool -d, this is roughly incorrect for two reasons. First of all,
drivers should always provide only original raw dumps to Ethtool without
any changes.
The second, and more critical, is that Ethtool's output buffer size is
strictly determined by ethtool_ops::get_regs_len(), and all data *must*
fit in it. The current version of driver always returns the size of raw
data, but the size of the formatted buffer exceeds it in most cases.
This leads to out-of-bound writes and memory corruption.

Address both issues by adding an option to return original, non-formatted
debug data, and using it for Ethtool case.

v2:
 - Expand commit message to make it more clear;
 - No functional changes.

Fixes: c965db44 ("qed: Add support for debug data collection")
Signed-off-by: default avatarAlexander Lobakin <alobakin@marvell.com>
Signed-off-by: default avatarIgor Russkikh <irusskikh@marvell.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent 5fc6266a
...@@ -876,6 +876,8 @@ struct qed_dev { ...@@ -876,6 +876,8 @@ struct qed_dev {
struct qed_dbg_feature dbg_features[DBG_FEATURE_NUM]; struct qed_dbg_feature dbg_features[DBG_FEATURE_NUM];
u8 engine_for_debug; u8 engine_for_debug;
bool disable_ilt_dump; bool disable_ilt_dump;
bool dbg_bin_dump;
DECLARE_HASHTABLE(connections, 10); DECLARE_HASHTABLE(connections, 10);
const struct firmware *firmware; const struct firmware *firmware;
......
...@@ -7506,6 +7506,12 @@ static enum dbg_status format_feature(struct qed_hwfn *p_hwfn, ...@@ -7506,6 +7506,12 @@ static enum dbg_status format_feature(struct qed_hwfn *p_hwfn,
if (p_hwfn->cdev->print_dbg_data) if (p_hwfn->cdev->print_dbg_data)
qed_dbg_print_feature(text_buf, text_size_bytes); qed_dbg_print_feature(text_buf, text_size_bytes);
/* Just return the original binary buffer if requested */
if (p_hwfn->cdev->dbg_bin_dump) {
vfree(text_buf);
return DBG_STATUS_OK;
}
/* Free the old dump_buf and point the dump_buf to the newly allocagted /* Free the old dump_buf and point the dump_buf to the newly allocagted
* and formatted text buffer. * and formatted text buffer.
*/ */
...@@ -7733,7 +7739,9 @@ int qed_dbg_mcp_trace_size(struct qed_dev *cdev) ...@@ -7733,7 +7739,9 @@ int qed_dbg_mcp_trace_size(struct qed_dev *cdev)
#define REGDUMP_HEADER_SIZE_SHIFT 0 #define REGDUMP_HEADER_SIZE_SHIFT 0
#define REGDUMP_HEADER_SIZE_MASK 0xffffff #define REGDUMP_HEADER_SIZE_MASK 0xffffff
#define REGDUMP_HEADER_FEATURE_SHIFT 24 #define REGDUMP_HEADER_FEATURE_SHIFT 24
#define REGDUMP_HEADER_FEATURE_MASK 0x3f #define REGDUMP_HEADER_FEATURE_MASK 0x1f
#define REGDUMP_HEADER_BIN_DUMP_SHIFT 29
#define REGDUMP_HEADER_BIN_DUMP_MASK 0x1
#define REGDUMP_HEADER_OMIT_ENGINE_SHIFT 30 #define REGDUMP_HEADER_OMIT_ENGINE_SHIFT 30
#define REGDUMP_HEADER_OMIT_ENGINE_MASK 0x1 #define REGDUMP_HEADER_OMIT_ENGINE_MASK 0x1
#define REGDUMP_HEADER_ENGINE_SHIFT 31 #define REGDUMP_HEADER_ENGINE_SHIFT 31
...@@ -7771,6 +7779,7 @@ static u32 qed_calc_regdump_header(struct qed_dev *cdev, ...@@ -7771,6 +7779,7 @@ static u32 qed_calc_regdump_header(struct qed_dev *cdev,
feature, feature_size); feature, feature_size);
SET_FIELD(res, REGDUMP_HEADER_FEATURE, feature); SET_FIELD(res, REGDUMP_HEADER_FEATURE, feature);
SET_FIELD(res, REGDUMP_HEADER_BIN_DUMP, 1);
SET_FIELD(res, REGDUMP_HEADER_OMIT_ENGINE, omit_engine); SET_FIELD(res, REGDUMP_HEADER_OMIT_ENGINE, omit_engine);
SET_FIELD(res, REGDUMP_HEADER_ENGINE, engine); SET_FIELD(res, REGDUMP_HEADER_ENGINE, engine);
...@@ -7794,6 +7803,7 @@ int qed_dbg_all_data(struct qed_dev *cdev, void *buffer) ...@@ -7794,6 +7803,7 @@ int qed_dbg_all_data(struct qed_dev *cdev, void *buffer)
omit_engine = 1; omit_engine = 1;
mutex_lock(&qed_dbg_lock); mutex_lock(&qed_dbg_lock);
cdev->dbg_bin_dump = true;
org_engine = qed_get_debug_engine(cdev); org_engine = qed_get_debug_engine(cdev);
for (cur_engine = 0; cur_engine < cdev->num_hwfns; cur_engine++) { for (cur_engine = 0; cur_engine < cdev->num_hwfns; cur_engine++) {
...@@ -7993,6 +8003,7 @@ int qed_dbg_all_data(struct qed_dev *cdev, void *buffer) ...@@ -7993,6 +8003,7 @@ int qed_dbg_all_data(struct qed_dev *cdev, void *buffer)
QED_NVM_IMAGE_MDUMP, "QED_NVM_IMAGE_MDUMP", rc); QED_NVM_IMAGE_MDUMP, "QED_NVM_IMAGE_MDUMP", rc);
} }
cdev->dbg_bin_dump = false;
mutex_unlock(&qed_dbg_lock); mutex_unlock(&qed_dbg_lock);
return 0; return 0;
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment