HomeFreeBSD

re: Avoid subobject overread when setting IDRn

Description

re: Avoid subobject overread when setting IDRn

IDR0-IDR5 can be read byte-by-byte but must be written to as 4-byte
words. The current code to do this is rather clunky and ends up reading
past the end of the union's eaddr member due to MAC addresses only being
6 bytes. In practice this ends up being fine because the align_dummy
member will pad the union to a multiple of 4 bytes, but this is dodgy,
and on CHERI with subobject bounds enforcement enabled, as is done in
CheriBSD's pure-capability kernel, will trap.

Instead, make the buffer in use the right size, just use an array of
uint32_t's rather than a char buffer that's then cast to uint32_t * to
simplify it in the process, and zero-initialise it first to avoid
reading uninitialised data in the trailing bytes.

Found by: CHERI
Reviewed by: jhb
Differential Revision: https://reviews.freebsd.org/D33617

Details

Provenance
jrtc27Authored on Dec 23 2021, 8:19 PM
Reviewer
jhb
Differential Revision
D33617: re: Avoid subobject overread when setting IDRn
Parents
rG95a70e9ea807: qca: add the TLMM code into the build
Branches
Unknown
Tags
Unknown