<div dir="ltr"><div dir="ltr"><br></div><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Tue, Nov 21, 2023 at 11:46 AM Andrew Lunn <<a href="mailto:andrew@lunn.ch" target="_blank">andrew@lunn.ch</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">On Tue, Nov 21, 2023 at 06:45:43PM +0000, Ray Zhang wrote:<br>
> CONFIG_KASAN detected out-of-bounds read via memcpy in stmmac_get_strings.<br>
> The fix is to change memcpy to strscpy.<br>
> <br>
> Tested:<br>
> <machine_obfuscated>:~# ethtool -i <interface_obfuscated><br>
> driver: st_gmac<br>
> <machine_obfuscated>:~# ethtool -S <interface_obfuscated><br>
> NIC statistics:<br>
> ATPES: 0<br>
> TPES: 0<br>
> RDPES: 0<br>
> MPES: 0<br>
> MTSPES: 0<br>
> ARPES: 0<br>
> CWPES: 0<br>
> ASRPES: 0<br>
> TTES: 0<br>
> RTES: 0<br>
> CTES: 0<br>
> ATES: 0<br>
> PTES: 0<br>
> T125ES: 0<br>
> R125ES: 0<br>
> RVCTES: 0<br>
> MSTTES: 0<br>
> SLVTES: 0<br>
> ATITES: 0<br>
> ARITES: 0<br>
> FSMPES: 0<br>
> TXCES: 0<br>
> TXAMS: 0<br>
> TXUES: 0<br>
> RXCES: 0<br>
> RXAMS: 0<br>
> RXUES: 0<br>
> ECES: 0<br>
> EAMS: 0<br>
> EUES: 0<br>
> RPCES: 0<br>
> RPAMS: 0<br>
> RPUES: 0<br>
> TCES: 0<br>
> TAMS: 0<br>
> TUES: 0<br>
> mmc_tx_octetcount_gb: 11612<br>
> mmc_tx_framecount_gb: 100<br>
> mmc_tx_broadcastframe_g: 0<br>
> mmc_tx_multicastframe_g: 42<br>
> mmc_tx_64_octets_gb: 0<br>
> mmc_tx_65_to_127_octets_gb: 62<br>
> mmc_tx_128_to_255_octets_gb: 38<br>
> mmc_tx_256_to_511_octets_gb: 0<br>
> mmc_tx_512_to_1023_octets_gb: 0<br>
> mmc_tx_1024_to_max_octets_gb: 0<br>
> mmc_tx_unicast_gb: 58<br>
> mmc_tx_multicast_gb: 42<br>
> mmc_tx_broadcast_gb: 0<br>
> mmc_tx_underflow_error: 0<br>
> mmc_tx_singlecol_g: 0<br>
> mmc_tx_multicol_g: 0<br>
> mmc_tx_deferred: 0<br>
> mmc_tx_latecol: 0<br>
> mmc_tx_exesscol: 0<br>
> mmc_tx_carrier_error: 0<br>
> mmc_tx_octetcount_g: 11612<br>
> mmc_tx_framecount_g: 100<br>
> mmc_tx_excessdef: 0<br>
> mmc_tx_pause_frame: 0<br>
> mmc_tx_vlan_frame_g: 0<br>
> mmc_rx_framecount_gb: 64<br>
> mmc_rx_octetcount_gb: 30235<br>
> mmc_rx_octetcount_g: 30235<br>
> mmc_rx_broadcastframe_g: 0<br>
> mmc_rx_multicastframe_g: 0<br>
> mmc_rx_crc_error: 0<br>
> mmc_rx_align_error: 0<br>
> mmc_rx_run_error: 0<br>
> mmc_rx_jabber_error: 0<br>
> mmc_rx_undersize_g: 0<br>
> mmc_rx_oversize_g: 0<br>
> mmc_rx_64_octets_gb: 0<br>
> mmc_rx_65_to_127_octets_gb: 9<br>
> mmc_rx_128_to_255_octets_gb: 22<br>
> mmc_rx_256_to_511_octets_gb: 21<br>
> mmc_rx_512_to_1023_octets_gb: 2<br>
> mmc_rx_1024_to_max_octets_gb: 10<br>
> mmc_rx_unicast_g: 64<br>
> mmc_rx_length_error: 0<br>
> mmc_rx_autofrangetype: 0<br>
> mmc_rx_pause_frames: 0<br>
> mmc_rx_fifo_overflow: 0<br>
> mmc_rx_vlan_frames_gb: 0<br>
> mmc_rx_watchdog_error: 0<br>
> mmc_rx_ipc_intr_mask: 0<br>
> mmc_rx_ipc_intr: 0<br>
> mmc_rx_ipv4_gd: 0<br>
> mmc_rx_ipv4_hderr: 0<br>
> mmc_rx_ipv4_nopay: 0<br>
> mmc_rx_ipv4_frag: 0<br>
> mmc_rx_ipv4_udsbl: 0<br>
> mmc_rx_ipv4_gd_octets: 0<br>
> mmc_rx_ipv4_hderr_octets: 0<br>
> mmc_rx_ipv4_nopay_octets: 0<br>
> mmc_rx_ipv4_frag_octets: 0<br>
> mmc_rx_ipv4_udsbl_octets: 0<br>
> mmc_rx_ipv6_gd_octets: 0<br>
> mmc_rx_ipv6_hderr_octets: 0<br>
> mmc_rx_ipv6_nopay_octets: 0<br>
> mmc_rx_ipv6_gd: 0<br>
> mmc_rx_ipv6_hderr: 0<br>
> mmc_rx_ipv6_nopay: 0<br>
> mmc_rx_udp_gd: 0<br>
> mmc_rx_udp_err: 0<br>
> mmc_rx_tcp_gd: 0<br>
> mmc_rx_tcp_err: 0<br>
> mmc_rx_icmp_gd: 0<br>
> mmc_rx_icmp_err: 0<br>
> mmc_rx_udp_gd_octets: 0<br>
> mmc_rx_udp_err_octets: 0<br>
> mmc_rx_tcp_gd_octets: 0<br>
> mmc_rx_tcp_err_octets: 0<br>
> mmc_rx_icmp_gd_octets: 0<br>
> mmc_rx_icmp_err_octets: 0<br>
> mmc_tx_fpe_fragment_cntr: 0<br>
> mmc_tx_hold_req_cntr: 0<br>
> mmc_rx_packet_assembly_err_cntr: 0<br>
> mmc_rx_packet_smd_err_cntr: 0<br>
> mmc_rx_packet_assembly_ok_cntr: 0<br>
> mmc_rx_fpe_fragment_cntr: 0<br>
> tx_underflow: 0<br>
> tx_carrier: 0<br>
> tx_losscarrier: 0<br>
> vlan_tag: 0<br>
> tx_deferred: 0<br>
> tx_vlan: 0<br>
> tx_jabber: 0<br>
> tx_frame_flushed: 0<br>
> tx_payload_error: 0<br>
> tx_ip_header_error: 0<br>
> rx_desc: 0<br>
> sa_filter_fail: 0<br>
> overflow_error: 0<br>
> ipc_csum_error: 0<br>
> rx_collision: 0<br>
> rx_crc_errors: 0<br>
> dribbling_bit: 0<br>
> rx_length: 0<br>
> rx_mii: 0<br>
> rx_multicast: 0<br>
> rx_gmac_overflow: 0<br>
> rx_watchdog: 0<br>
> da_rx_filter_fail: 0<br>
> sa_rx_filter_fail: 0<br>
> rx_missed_cntr: 0<br>
> rx_overflow_cntr: 0<br>
> rx_vlan: 0<br>
> rx_split_hdr_pkt_n: 0<br>
> tx_undeflow_irq: 0<br>
> tx_process_stopped_irq: 0<br>
> tx_jabber_irq: 0<br>
> rx_overflow_irq: 0<br>
> rx_buf_unav_irq: 0<br>
> rx_process_stopped_irq: 0<br>
> rx_watchdog_irq: 0<br>
> tx_early_irq: 0<br>
> fatal_bus_error_irq: 0<br>
> rx_early_irq: 0<br>
> threshold: 64<br>
> tx_pkt_n: 100<br>
> rx_pkt_n: 64<br>
> normal_irq_n: 62<br>
> rx_normal_irq_n: 58<br>
> napi_poll: 215<br>
> tx_normal_irq_n: 4<br>
> tx_clean: 157<br>
> tx_set_ic_bit: 4<br>
> irq_receive_pmt_irq_n: 0<br>
> mmc_tx_irq_n: 0<br>
> mmc_rx_irq_n: 0<br>
> mmc_rx_csum_offload_irq_n: 0<br>
> irq_tx_path_in_lpi_mode_n: 0<br>
> irq_tx_path_exit_lpi_mode_n: 0<br>
> irq_rx_path_in_lpi_mode_n: 0<br>
> irq_rx_path_exit_lpi_mode_n: 0<br>
> phy_eee_wakeup_error_n: 0<br>
> ip_hdr_err: 0<br>
> ip_payload_err: 0<br>
> ip_csum_bypassed: 0<br>
> ipv4_pkt_rcvd: 0<br>
> ipv6_pkt_rcvd: 64<br>
> no_ptp_rx_msg_type_ext: 64<br>
> ptp_rx_msg_type_sync: 0<br>
> ptp_rx_msg_type_follow_up: 0<br>
> ptp_rx_msg_type_delay_req: 0<br>
> ptp_rx_msg_type_delay_resp: 0<br>
> ptp_rx_msg_type_pdelay_req: 0<br>
> ptp_rx_msg_type_pdelay_resp: 0<br>
> ptp_rx_msg_type_pdelay_follow_up: 0<br>
> ptp_rx_msg_type_announce: 0<br>
> ptp_rx_msg_type_management: 0<br>
> ptp_rx_msg_pkt_reserved_type: 0<br>
> ptp_frame_type: 0<br>
> ptp_ver: 0<br>
> timestamp_dropped: 0<br>
> av_pkt_rcvd: 0<br>
> av_tagged_pkt_rcvd: 0<br>
> vlan_tag_priority_val: 0<br>
> l3_filter_match: 0<br>
> l4_filter_match: 0<br>
> l3_l4_filter_no_match: 0<br>
> irq_pcs_ane_n: 0<br>
> irq_pcs_link_n: 0<br>
> irq_rgmii_n: 0<br>
> mtl_tx_status_fifo_full: 0<br>
> mtl_tx_fifo_not_empty: 0<br>
> mmtl_fifo_ctrl: 0<br>
> mtl_tx_fifo_read_ctrl_write: 0<br>
> mtl_tx_fifo_read_ctrl_wait: 0<br>
> mtl_tx_fifo_read_ctrl_read: 0<br>
> mtl_tx_fifo_read_ctrl_idle: 0<br>
> mac_tx_in_pause: 0<br>
> mac_tx_frame_ctrl_xfer: 0<br>
> mac_tx_frame_ctrl_idle: 0<br>
> mac_tx_frame_ctrl_wait: 0<br>
> mac_tx_frame_ctrl_pause: 0<br>
> mac_gmii_tx_proto_engine: 0<br>
> mtl_rx_fifo_fill_level_full: 0<br>
> mtl_rx_fifo_fill_above_thresh: 0<br>
> mtl_rx_fifo_fill_below_thresh: 0<br>
> mtl_rx_fifo_fill_level_empty: 0<br>
> mtl_rx_fifo_read_ctrl_flush: 0<br>
> mtl_rx_fifo_read_ctrl_read_data: 0<br>
> mtl_rx_fifo_read_ctrl_status: 0<br>
> mtl_rx_fifo_read_ctrl_idle: 0<br>
> mtl_rx_fifo_ctrl_active: 0<br>
> mac_rx_frame_ctrl_fifo: 0<br>
> mac_gmii_rx_proto_engine: 0<br>
> tx_tso_frames: 0<br>
> tx_tso_nfrags: 0<br>
> mtl_est_cgce: 0<br>
> mtl_est_hlbs: 0<br>
> mtl_est_hlbf: 0<br>
> mtl_est_btre: 0<br>
> mtl_est_btrlm: 0<br>
> q0_tx_pkt_n: 100<br>
> q0_tx_irq_n: 4<br>
> q0_rx_pkt_n: 64<br>
> q0_rx_irq_n: 58<br>
<br>
What useful information does this list of statistics bring in the<br>
commit message?<br>
<br></blockquote><div>Each output line of "ethtool -S" is from the modified code: It shows the command still yields normal output results as expected.<br> </div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">
> if (!stmmac_safety_feat_dump(priv,<br>
> &priv->sstats, i,<br>
> NULL, &desc)) {<br>
> - memcpy(p, desc, ETH_GSTRING_LEN);<br>
> + strscpy(p, desc, ETH_GSTRING_LEN);<br>
<br>
Did you consider ethtool_puts() ?</blockquote><div>No, since strscpy does the job already. Also I could not find ethtool_puts: where is it defined? Or do you mean ethtool_put_stat, which is inappropriate to use here since it requires a skb parameter? <br><br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><br>
Andrew<br>
<br>
---<br>
pw-bot: cr<br></blockquote><div><br><font color="#555555"><span>Hi Andrew, Thanks for reviewing, please see inline.<br><br></span></font></div><div>Ray </div></div></div>