In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
bnxt_en: Bound SW TPA IDs to prevent crashes<\/p>\n
FW supports up to 1024 concurrent TPAs, so the FW TPA ID is in the range
\n0..1023 (see commit ec4d8e7cf024 (“bnxt_en: Add TPA ID mapping logic for
\n57500 chips.”)). bnxt_alloc_agg_idx is intended to wrap the FW ID down to a
\nsoftware ID which is used to index rxr->rx_tpa, and to generate a mapping
\nbetween FW IDs and the wrapped software ID.<\/p>\n
On a 57608 with firmware version 233, the firmware advertises 32
\nconcurrent TPAs. As of the commit under fixes, bp->max_tpa on this NIC
\nis set to 32.<\/p>\n
If the software ID from bnxt_alloc_agg_idx is above 31, this results in
\nan invalid address being loaded on this line:<\/p>\n
tpa_info = &rxr->rx_tpa[agg_id];<\/p>\n
because rx_tpa is allocated with only bp->max_tpa (32) entries. Writes
\nto tpa_info later in the code are out of bounds.<\/p>\n
This bug results in a crash at boot:<\/p>\n
Oops: general protection fault, kernel NULL pointer dereference 0x8: 0000 [#1] SMP NOPTI
\nRIP: 0010:bnxt_rx_pkt+0xc0\/0x1560
\nRSP: 0018:ffffc900009b8c78 EFLAGS: 00010246
\nRAX: 0000000000000000 RBX: 0000000000000048 RCX: 0000000206682516
\nRDX: ffffc900009b8db4 RSI: 0000000000000000 RDI: 01ffffff038fe1c0
\nRBP: ffffc9006e687480 R08: ffffc9006e687000 R09: 0000000000003048
\nR10: 0000000000000480 R11: ffff8881c6083900 R12: 0000000006682516
\nR13: ffff8881c6095400 R14: 0000000000000016 R15: ffff8881c6b66680
\nFS: 0000000000000000(0000) GS:ffff88fef3c77000(0000) knlGS:0000000000000000
\nCS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
\nCR2: 00007fc8bda40584 CR3: 000000807c812001 CR4: 0000000008772ef0
\nPKRU: 55555554
\nCall Trace:<\/p>\n
? __netif_receive_skb_list_core+0x1ca\/0x250
\n __bnxt_poll_work+0x152\/0x280
\n bnxt_poll_p5+0x1cd\/0x480
\n __napi_poll+0x30\/0x180
\n net_rx_action+0x20b\/0x3b0
\n ? note_gp_changes+0x53\/0xe0
\n ? tick_setup_sched_timer+0x180\/0x180
\n ? __napi_schedule+0x9a\/0xb0
\n ? bnxt_msix+0x24\/0x30
\n handle_softirqs+0xdd\/0x2c0
\n __irq_exit_rcu.llvm.3171231171502365008+0x47\/0xf0
\n common_interrupt+0x85\/0x90<\/p>\n
asm_common_interrupt+0x22\/0x40<\/p>\n
This stack trace is from a crash triggered when an out of bounds rx_tpa
\nis dereferenced. The invalid write mentioned above is silent in this
\nparticular crash.<\/p>\n
Fix this by allocating rx_tpa with bp->max_tpa rounded up to the next
\npower of 2 (bp->max_tpa_roundup_size) entries and masking the FW TPA ID
\nwith that size, so the wrapped ID can never index past the end of the
\narray.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
bnxt_en: Bound SW TPA IDs to prevent crashes<\/p>\n
FW supports up to 1024 concurrent TPAs, so the FW TPA ID is in the range
\n0..1023 (see<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-29002","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/29002","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=29002"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=29002"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=29002"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}