lkml.org 
[lkml]   [2018]   [Sep]   [7]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 4.18 130/145] libnvdimm: fix ars_status output length calculation
    Date
    4.18-stable review patch.  If anyone has any objections, please let me know.

    ------------------

    From: Vishal Verma <vishal.l.verma@intel.com>

    commit 286e87718103acdf85f4ed323a37e4839a8a7c05 upstream.

    Commit efda1b5d87cb ("acpi, nfit, libnvdimm: fix / harden ars_status output length handling")
    Introduced additional hardening for ambiguity in the ACPI spec for
    ars_status output sizing. However, it had a couple of cases mixed up.
    Where it should have been checking for (and returning) "out_field[1] -
    4" it was using "out_field[1] - 8" and vice versa.

    This caused a four byte discrepancy in the buffer size passed on to
    the command handler, and in some cases, this caused memory corruption
    like:

    ./daxdev-errors.sh: line 76: 24104 Aborted (core dumped) ./daxdev-errors $busdev $region
    malloc(): memory corruption
    Program received signal SIGABRT, Aborted.
    [...]
    #5 0x00007ffff7865a2e in calloc () from /lib64/libc.so.6
    #6 0x00007ffff7bc2970 in ndctl_bus_cmd_new_ars_status (ars_cap=ars_cap@entry=0x6153b0) at ars.c:136
    #7 0x0000000000401644 in check_ars_status (check=0x7fffffffdeb0, bus=0x604c20) at daxdev-errors.c:144
    #8 test_daxdev_clear_error (region_name=<optimized out>, bus_name=<optimized out>)
    at daxdev-errors.c:332

    Cc: <stable@vger.kernel.org>
    Cc: Dave Jiang <dave.jiang@intel.com>
    Cc: Keith Busch <keith.busch@intel.com>
    Cc: Lukasz Dorau <lukasz.dorau@intel.com>
    Cc: Dan Williams <dan.j.williams@intel.com>
    Fixes: efda1b5d87cb ("acpi, nfit, libnvdimm: fix / harden ars_status output length handling")
    Signed-off-by: Vishal Verma <vishal.l.verma@intel.com>
    Reviewed-by: Keith Busch <keith.busch@intel.com>
    Signed-of-by: Dave Jiang <dave.jiang@intel.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

    ---
    drivers/nvdimm/bus.c | 4 ++--
    1 file changed, 2 insertions(+), 2 deletions(-)

    --- a/drivers/nvdimm/bus.c
    +++ b/drivers/nvdimm/bus.c
    @@ -812,9 +812,9 @@ u32 nd_cmd_out_size(struct nvdimm *nvdim
    * overshoots the remainder by 4 bytes, assume it was
    * including 'status'.
    */
    - if (out_field[1] - 8 == remainder)
    + if (out_field[1] - 4 == remainder)
    return remainder;
    - return out_field[1] - 4;
    + return out_field[1] - 8;
    } else if (cmd == ND_CMD_CALL) {
    struct nd_cmd_pkg *pkg = (struct nd_cmd_pkg *) in_field;


    \
     
     \ /
      Last update: 2018-09-07 23:58    [W:2.049 / U:0.064 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site