Bug#960702: [PATCH net] mlx4: Fix information leak on failure to read module EEPROM

From	Ben Hutchings <ben@decadent.org.uk>
Newsgroups	linux.debian.bugs.dist, linux.debian.kernel
Subject	Bug#960702: [PATCH net] mlx4: Fix information leak on failure to read module EEPROM
Date	2020-05-17 19:30 +0200
Message-ID	<A7vgR-8nX-5@gated-at.bofh.it> (permalink)
References	<A6KrD-4d1-3@gated-at.bofh.it>
Organization	linux.* mail to news gateway

Cross-posted to 2 groups.

Show all headers | View raw

[Multipart message — attachments visible in raw view] - view raw

mlx4_en_get_module_eeprom() returns 0 even if it fails.  This results
in copying an uninitialised (or partly initialised) buffer back to
user-space.

Change it so that:

* In the special case that the DOM turns out not to be readable, the
  remaining part of the buffer is cleared.  This should avoid a
  regression when reading modules with this problem.

* In other error cases, the error code is propagated.

Reported-by: Yannis Aribaud <bugs@d6bell.net>
References: https://bugs.debian.org/960702
Fixes: 7202da8b7f71 ("ethtool, net/mlx4_en: Cable info, get_module_info/...")
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
This is compile-tested only.  It should go to stable, if it is a
correct fix.

Ben.

 drivers/net/ethernet/mellanox/mlx4/en_ethtool.c | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/drivers/net/ethernet/mellanox/mlx4/en_ethtool.c b/drivers/net/ethernet/mellanox/mlx4/en_ethtool.c
index 8a5ea2543670..6edc3177af1c 100644
--- a/drivers/net/ethernet/mellanox/mlx4/en_ethtool.c
+++ b/drivers/net/ethernet/mellanox/mlx4/en_ethtool.c
@@ -2078,14 +2078,17 @@ static int mlx4_en_get_module_eeprom(struct net_device *dev,
 		ret = mlx4_get_module_info(mdev->dev, priv->port,
 					   offset, ee->len - i, data + i);
 
-		if (!ret) /* Done reading */
+		if (!ret) {
+			/* DOM was not readable after all */
+			memset(data + i, 0, ee->len - i);
 			return 0;
+		}
 
 		if (ret < 0) {
 			en_err(priv,
 			       "mlx4_get_module_info i(%d) offset(%d) bytes_to_read(%d) - FAILED (0x%x)\n",
 			       i, offset, ee->len - i, ret);
-			return 0;
+			return ret;
 		}
 
 		i += ret;

Thread

Bug#960702: ethtool -m values change when output is redirected "Yannis Aribaud" <bugs@d6bell.net> - 2020-05-15 17:30 +0200
  Bug#960702: ethtool -m values change when output is redirected Bjørn Mork <bjorn@mork.no> - 2020-05-15 19:00 +0200
    Bug#960702: ethtool -m values change when output is redirected "Yannis Aribaud" <bugs@d6bell.net> - 2020-05-15 19:40 +0200
  Bug#960702: ethtool -m values change when output is redirected Ben Hutchings <ben@decadent.org.uk> - 2020-05-16 01:40 +0200
    Bug#960702: ethtool -m values change when output is redirected "Yannis Aribaud" <bugs@d6bell.net> - 2020-05-17 17:00 +0200
      Bug#960702: ethtool -m values change when output is redirected Ben Hutchings <ben@decadent.org.uk> - 2020-05-17 18:10 +0200
        Bug#960702: ethtool -m values change when output is redirected "Yannis Aribaud" <bugs@d6bell.net> - 2020-05-18 12:10 +0200
  Processed: Re: Bug#960702: ethtool -m values change when output  is redirected "Debian Bug Tracking System" <owner@bugs.debian.org> - 2020-05-16 01:40 +0200
  Processed: Re: Bug#960702: ethtool -m values change when output  is redirected "Debian Bug Tracking System" <owner@bugs.debian.org> - 2020-05-17 18:10 +0200
  Bug#960702: [PATCH net] mlx4: Fix information leak on failure to read module EEPROM Ben Hutchings <ben@decadent.org.uk> - 2020-05-17 19:30 +0200
  Bug#960702: [PATCH net] mlx4: Fix information leak on failure to read module EEPROM Ben Hutchings <ben@decadent.org.uk> - 2020-05-18 20:30 +0200

csiph-web