commit	c2b833e40ddb858a94734f77a0bd761b76733c65	[log] [tgz]
author	Andrew Jeffery <andrew@aj.id.au>	Wed Oct 28 14:28:37 2020 +1030
committer	Andrew Jeffery <andrew@aj.id.au>	Fri Nov 06 01:04:03 2020 +0000
tree	4029d615f035587507633b4c118e7cede6c2f73c
parent	5a508915d68c7bb096241e3da29793411789d9e8 [diff]

core: Fix large packet buffer overrun

The astlpc binding allows negotiation of Tx/Rx region sizes, but the
packet accumulator assumed packet sizes were at most 4096 bytes.  Avoid
buffer overflow by allocating at least the length of the inbound packet
if we have not yet initialised the packet buffer.

Fixes:

=================================================================
==42296==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x621000002500 at pc 0x7ff8a22235ce bp 0x7ffd47469750 sp 0x7ffd47468ef8
WRITE of size 8192 at 0x621000002500 thread T0
    #0 0x7ff8a22235cd in __interceptor_memcpy (/usr/lib/x86_64-linux-gnu/libasan.so.6+0x3a5cd)
    #1 0x7ff8a21ac78b in memcpy /usr/include/x86_64-linux-gnu/bits/string_fortified.h:34
    #2 0x7ff8a21ac78b in mctp_msg_ctx_add_pkt /home/andrew/src/openbmc/libmctp/core.c:237
    #3 0x7ff8a21af245 in mctp_bus_rx /home/andrew/src/openbmc/libmctp/core.c:495
    #4 0x56458d3f9648 in mctp_astlpc_rx_start astlpc.c:813
    #5 0x56458d3f9648 in mctp_astlpc_poll astlpc.c:931
    #6 0x56458d3fc1f4 in astlpc_test_send_large_packet tests/test_astlpc.c:1111
    #7 0x56458d3efc86 in main tests/test_astlpc.c:1185
    #8 0x7ff8a165dcb1 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x28cb1)
    #9 0x56458d3efe7d in _start (/home/andrew/src/openbmc/libmctp/tests/.libs/test_astlpc+0x17e7d)

0x621000002500 is located 0 bytes to the right of 4096-byte region [0x621000001500,0x621000002500)
allocated by thread T0 here:
    #0 0x7ff8a22998d0 in __interceptor_realloc (/usr/lib/x86_64-linux-gnu/libasan.so.6+0xb08d0)
    #1 0x7ff8a21b0533 in __mctp_realloc /home/andrew/src/openbmc/libmctp/alloc.c:48

SUMMARY: AddressSanitizer: heap-buffer-overflow (/usr/lib/x86_64-linux-gnu/libasan.so.6+0x3a5cd) in __interceptor_memcpy
Shadow bytes around the buggy address:
  0x0c427fff8450: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c427fff8460: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c427fff8470: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c427fff8480: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c427fff8490: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
=>0x0c427fff84a0:[fa]fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c427fff84b0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c427fff84c0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c427fff84d0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c427fff84e0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c427fff84f0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
  Shadow gap:              cc
==42296==ABORTING

Signed-off-by: Andrew Jeffery <andrew@aj.id.au>
Change-Id: I9d39090cb9246ec2f6c06942d4f2a91fe0df0202

2 files changed

tree: 4029d615f035587507633b4c118e7cede6c2f73c

README.md

libmctp: Implementation of MCTP (DTMF DSP0236)

This library is intended to be a portable implementation of the Management Component Transport Protocol (MCTP), as defined by DMTF standard "DSP0236", plus transport binding specifications.

Currently, the library is is only at prototyping stage. Interfaces will likely change, and are missing lots of components of the standard.

Core API

To initialise the MCTP stack with a single hardware bus:

mctp = mctp_init(): Initialise the MCTP core
binding = mctp_<binding>_init(): Initialise a hardware binding
mctp_register_bus(mctp, binding, eid): Register the hardware binding with the core, using a predefined EID

Then, register a function call to be invoked when a message is received:

mctp_set_rx_all(mctp, function): Provide a callback to be invoked when a MCTP message is received

Or transmit a message:

mctp_message_tx(mctp, message, len): Transmit a MCTP message

The binding may require you to notify it to receive packets. For example, for the serial binding, the mctp_serial_read() function should be invoked when the file-descriptor for the serial device has data available.

Bridging

libmctp implements basic support for bridging between two hardware bindings. In this mode, bindings may have different MTUs, so packets are reassembled into their messages, then the messages are re-packetised for the outgoing binding.

For bridging between two endpoints, use the mctp_bridge_busses() function:

mctp = mctp_init(): Initialise the MCTP core
b1 = mctp_<binding>_init(); b2 = mctp_<binding>_init(): Initialise two hardware bindings
mctp_bridge_busses(mctp, b1, b2): Setup bridge

Note that no EIDs are defined here; the bridge does not deliver any messages to a local rx callback, and messages are bridged as-is.

Binding API

Hardware bindings provide a method for libmctp to send and receive packets to/from hardware. A binding defines a hardware specific structure (struct mctp_binding_<name>), which wraps the generic binding (struct mctp_binding):

struct mctp_binding_foo {
    struct mctp_binding binding;
    /* hardware-specific members here... */
};

The binding code then provides a method (_init) to allocate and initialise the binding; this may be of any prototype (calling code will know what arguments to pass):

struct mctp_binding_foo *mctp_binding_foo_init(void);

or maybe the foo binding needs a path argument:

struct mctp_binding_foo *mctp_binding_foo_init(const char *path);

The binding then needs to provide a function (_core) to convert the hardware-specific struct to the libmctp generic core struct

struct mctp_binding *mctp_binding_foo_core(struct mctp_binding_foo *b);

(Implementations of this will usually be fairly consistent, just returning b->binding). Callers can then use that generic pointer to register the binding with the core:

struct mctp_binding *binding = mctp_binding_foo_core(foo);
mctp_register_bus(mctp, binding, 8);

Integration

The libmctp code is intended to be integrated into other codebases by two methods:

as a simple library (libmctp.{a,so}) which can be compiled separately and linked into the containing project
as a set of sources to be included into the containing project (either imported, or as a git subtree/submodule)

For (1), you can use the top-level makefile to produce libmtcp.a.

For (2), the Makefile.inc file provides the minimum set of dependencies to either build libmctp.a, or just the actual object files (LIBMCTP_OBS), which you can include into your existing make definitions. You'll want to set LIBMTCP_DIR to refer to the subdirectory that contains that makefile, so we can set the correct paths to sources.

Environment configuration

This library is intended to be portable to be used in a range of environments, but the main targets are:

Linux userspace, typically for BMC use-cases
Low-level firmware environments

For the latter, we need to support customisation of the functions that libmctp uses (for example, POSIX file IO is not available).

In order to support these, we have a few compile-time definitions:

MCTP_HAVE_FILEIO: define if POSIX file io is available, allowing the serial hardware binding to access char devices for IO.
MCTP_HAVE_SYSLOG: allow logging to syslog, through the vsyslog call.
MCTP_DEFAULT_ALLOC: set default allocator functions (malloc, free, realloc), so that applications do not have to provide their own.

TODO

Partial packet queue transmit
Control messages
Message- and packet-buffer pools and preallocation
C++ API
Non-file-based serial binding