From nobody Tue May 10 13:13:36 2022 X-Original-To: bugs@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id BAFE81ACB823 for ; Tue, 10 May 2022 13:13:36 +0000 (UTC) (envelope-from bugzilla-noreply@freebsd.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "R3" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 4KyJQ83CM5z3K9T for ; Tue, 10 May 2022 13:13:36 +0000 (UTC) (envelope-from bugzilla-noreply@freebsd.org) Received: from kenobi.freebsd.org (kenobi.freebsd.org [IPv6:2610:1c1:1:606c::50:1d]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (Client did not present a certificate) by mxrelay.nyi.freebsd.org (Postfix) with ESMTPS id 4F56C260B6 for ; Tue, 10 May 2022 13:13:36 +0000 (UTC) (envelope-from bugzilla-noreply@freebsd.org) Received: from kenobi.freebsd.org ([127.0.1.5]) by kenobi.freebsd.org (8.15.2/8.15.2) with ESMTP id 24ADDaE2078430 for ; Tue, 10 May 2022 13:13:36 GMT (envelope-from bugzilla-noreply@freebsd.org) Received: (from www@localhost) by kenobi.freebsd.org (8.15.2/8.15.2/Submit) id 24ADDahP078429 for bugs@FreeBSD.org; Tue, 10 May 2022 13:13:36 GMT (envelope-from bugzilla-noreply@freebsd.org) X-Authentication-Warning: kenobi.freebsd.org: www set sender to bugzilla-noreply@freebsd.org using -f From: bugzilla-noreply@freebsd.org To: bugs@FreeBSD.org Subject: [Bug 263896] Interger overflow in buffer size calculation in sys/dev/e1000/if_em.c Date: Tue, 10 May 2022 13:13:36 +0000 X-Bugzilla-Reason: AssignedTo X-Bugzilla-Type: new X-Bugzilla-Watch-Reason: None X-Bugzilla-Product: Base System X-Bugzilla-Component: kern X-Bugzilla-Version: Unspecified X-Bugzilla-Keywords: X-Bugzilla-Severity: Affects Some People X-Bugzilla-Who: hannula@gmail.com X-Bugzilla-Status: New X-Bugzilla-Resolution: X-Bugzilla-Priority: --- X-Bugzilla-Assigned-To: bugs@FreeBSD.org X-Bugzilla-Flags: X-Bugzilla-Changed-Fields: bug_id short_desc product version rep_platform op_sys bug_status bug_severity priority component assigned_to reporter Message-ID: Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable X-Bugzilla-URL: https://bugs.freebsd.org/bugzilla/ Auto-Submitted: auto-generated List-Id: Bug reports List-Archive: https://lists.freebsd.org/archives/freebsd-bugs List-Help: List-Post: List-Subscribe: List-Unsubscribe: Sender: owner-freebsd-bugs@freebsd.org MIME-Version: 1.0 ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1652188416; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=6IANcvfGU9nZe8s6Cr2hsHCit2K2q+0UPdVHljC7P28=; b=FM0ygTY8RrVror0NRh14GHk2gAk1MrgsHvvqc/jikjt//nnRqaWu9O2/w0MWlVSOOjNw4T MCG7qafNwfF6P7b7CNlkhkKsHbvjFyLQK8scSnKWt6jF/grl4OUOBVe3lCMCXNJwMXgBdE VUpW1DVvnUnhxKUcQwACBpibefJXGuk/2pwS1l8oLR2wF53nFlBxHbTHX2/caI6YXW5b2E T/2Dwza/sXLPcWwnTfDg5SRoO4j4heBZPfUOEd1ndcRu5zb4d5FPnomxzw3RO6EMKT/S3N LiQKNxXP0omg4LE5Hs4qgY/FfrkIR6046Ro/X3BZ0SaeYPz5uEbv7jxTDLokXw== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1652188416; a=rsa-sha256; cv=none; b=Ez7saw0xeVrzE0L1Rqe2c8BpWZFufQjikKFH48ipUPct4eoFsfNTB2G33lDI7q58QhelZh xzXzfzczs+qb/F2OBXoT0E5QyOkHk/zUFEZE9WrRUsp0aT2VuNtv77tWHY0Jibq8Eh4/iO EJBrUgOAstIyuQkmjTjHavVPLOqXAncKVkRq6Oiv2aHTRG33l80xuDPtxd99123ukWYz5V b9An2KCYGMV1Vb22puq6V1IXsoIz2cZ+gt0CW60S25potDP65w/Ta7oBCoHkqyUW5fMXoJ WF8OEvKOLbDpTmWT/iucsDf8F1bKGGX+O+rPaGDvP6fyAzVqhHMxadMJ3pLzbw== ARC-Authentication-Results: i=1; mx1.freebsd.org; none X-ThisMailContainsUnwantedMimeParts: N https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=3D263896 Bug ID: 263896 Summary: Interger overflow in buffer size calculation in sys/dev/e1000/if_em.c Product: Base System Version: Unspecified Hardware: Any OS: Any Status: New Severity: Affects Some People Priority: --- Component: kern Assignee: bugs@FreeBSD.org Reporter: hannula@gmail.com In sys/dev/e1000/if_em.c the RX buffer is defined as: u16 rx_buffer_size so max value is 65535. Later it is used to calculate the buffer water levels: rx_buffer_size =3D (pba & 0xffff) << 10; hw->fc.high_water =3D rx_buffer_size - roundup2(hw->mac.max_frame_size, 102= 4); This is ok for example for 36KB when pba is 0x36 fc.high_water is calculate= d as 36864-2048=3D34816. But for I350 when only 2 ports are used PBA size can be set as 72KB (see datasheet RXPbsize or e1000_rxpbs_adjust_82580 function in e1000_82575.c). In this case calculating the rx_buffer_size overflows as 0x0048 << 10 =3D 7= 3728 or 0x12000 pushed into u16. It is then set as 0x2000 or 8192. Tested on my dual port I350 vs quad port I350: On quad port the PBA size is 36KB and is calculated correctly 36864-2048=3D= 34816: dev.igb.0.fc_low_water: 34800 dev.igb.0.fc_high_water: 34816 On dual port the PBA size is 72KB and totally wrong values are set corresponding to 8192-2048=3D6144: dev.igb.0.fc_low_water: 6128 dev.igb.0.fc_high_water: 6144 One can verify what PBA is set in hardware with enabling verbose boot: kernel: em_reset: pba=3D36K kernel: em_reset: pba=3D72K --=20 You are receiving this mail because: You are the assignee for the bug.=