From owner-freebsd-bugs@FreeBSD.ORG Fri Apr 20 13:40:11 2012 Return-Path: Delivered-To: freebsd-bugs@hub.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34]) by hub.freebsd.org (Postfix) with ESMTP id 9B3BE106564A for ; Fri, 20 Apr 2012 13:40:11 +0000 (UTC) (envelope-from gnats@FreeBSD.org) Received: from freefall.freebsd.org (freefall.freebsd.org [IPv6:2001:4f8:fff6::28]) by mx1.freebsd.org (Postfix) with ESMTP id 6B7498FC0A for ; Fri, 20 Apr 2012 13:40:11 +0000 (UTC) Received: from freefall.freebsd.org (localhost [127.0.0.1]) by freefall.freebsd.org (8.14.5/8.14.5) with ESMTP id q3KDeBfd003374 for ; Fri, 20 Apr 2012 13:40:11 GMT (envelope-from gnats@freefall.freebsd.org) Received: (from gnats@localhost) by freefall.freebsd.org (8.14.5/8.14.5/Submit) id q3KDeBFm003373; Fri, 20 Apr 2012 13:40:11 GMT (envelope-from gnats) Date: Fri, 20 Apr 2012 13:40:11 GMT Message-Id: <201204201340.q3KDeBFm003373@freefall.freebsd.org> To: freebsd-bugs@FreeBSD.org From: Scott Long Cc: Subject: Re: kern/155658: [amr] [patch] amr_ioctl(): call of malloc() causes memory corruption and panic X-BeenThere: freebsd-bugs@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list Reply-To: Scott Long List-Id: Bug reports List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 20 Apr 2012 13:40:11 -0000 The following reply was made to PR kern/155658; it has been noted by GNATS. From: Scott Long To: Scott Long Cc: John Baldwin , Andreas Longwitz , "bug-followup@freebsd.org" , "scottl@freebsd.org" Subject: Re: kern/155658: [amr] [patch] amr_ioctl(): call of malloc() causes memory corruption and panic Date: Fri, 20 Apr 2012 07:35:26 -0600 "openbsd". When computers attack! On Apr 20, 2012, at 7:30 AM, Scott Long wrote: > Worst firmware ever. Seriously. If this was open bad, the driver would b= e removed and the hardware blacklisted as a security threat. >=20 > Scott >=20 > On Apr 20, 2012, at 6:13 AM, John Baldwin wrote: >=20 >> On Thursday, April 19, 2012 4:12:50 pm Andreas Longwitz wrote: >>> John, >>> I did several tests with your patch in 8.2 and everything works fine, if= >>> I use the binary version of megarc with the patch included described in >>> ports/137938. >>>=20 >>> The original megarc sends amr_ioctl's with length 12868 (e.g. the first >>> ioctl of the command "megarc -ctlrinfo -a0") and your patch calls the >>> controller with real_length=3D16384, but the controller returns 25412 >>> Bytes. This happens all the time on nearly every megarc command, I think= >>> this is a program error in megarc, he uses user_cmd=3D0xa104 with buffer= >>> length 12868, but the firmware of the controller replies with 25412 >>> bytes. So we have memory corruption of 25412 - 16384 =3D 9026 bytes. The= >>> patch in ports/137938 changes the lenght field in megarc from 12868 to >>> 25412 to avoid this problem. A line like >>> if( len =3D=3D 12868 ) len =3D 25412; >>> would solve this problem in the driver. I did not find any other static >>> problems of this type. >>>=20 >>> Another story are dynamic problems. When the controller is very busy, I >>> see sometimes 1KB bytes returned from the controller, when lenght is >>> much lower. This problem is handled by your patch in all cases. >>>=20 >>> Andreas Longwitz >>=20 >> Ah, ok. I think we should just make the minimum buffer size 32k which >> should workaround this. I've updated the patch at the same URL: >>=20 >> http://www.freebsd.org/~jhb/patches/amr_buffer_len.patch >>=20 >> --=20 >> John Baldwin