Messages in this thread Patch in this message | | | From | Toshi Kani <> | Subject | [PATCH v2] EDAC/ghes: Fix buffer overflow in ghes_edac_register() | Date | Thu, 21 Jul 2022 12:05:03 -0600 |
| |
The following buffer overflow BUG was observed on an HPE system. ghes_edac_register() called strlen() on an uninitialized label, which had non-zero values from krealloc_array().
In dimm_setup_label(), *device was set but *bank was null, which left the label uninitialized. *bank is set from SMBIOS type 17 Bank Locator, offset 11h. This system had this value set to 0x0 (null string).
Change dimm_setup_label() to always initialize the label and use "NA" in case bank or device is null.
detected buffer overflow in __fortify_strlen ------------[ cut here ]------------ kernel BUG at lib/string_helpers.c:983! invalid opcode: 0000 [#1] PREEMPT SMP NOPTI CPU: 1 PID: 1 Comm: swapper/0 Tainted: G I 5.18.6-200.fc36.x86_64 #1 Hardware name: HPE ProLiant DL360 Gen10/ProLiant DL360 Gen10, BIOS U32 03/15/2019 RIP: 0010:fortify_panic+0xf/0x11 ... Call Trace: <TASK> ghes_edac_register.cold+0x128/0x128 ghes_probe+0x142/0x3a0 platform_probe+0x41/0x90 really_probe+0x19e/0x370 __driver_probe_device+0xfc/0x170 driver_probe_device+0x1f/0x90 __driver_attach+0xbb/0x190 ? __device_attach_driver+0xe0/0xe0 bus_for_each_dev+0x5f/0x90 bus_add_driver+0x159/0x200 driver_register+0x89/0xd0 acpi_ghes_init+0x72/0xc3 acpi_init+0x441/0x493 ? acpi_sleep_proc_init+0x24/0x24 do_one_initcall+0x41/0x200
Fixes: b9cae27728d1f ("EDAC/ghes: Scan the system once on driver init") Tested-by: Robert Elliott <elliott@hpe.com> Signed-off-by: Toshi Kani <toshi.kani@hpe.com> Cc: Robert Richter <rrichter@marvell.com> Cc: Borislav Petkov <bp@suse.de> Cc: Mauro Carvalho Chehab <mchehab@kernel.org> --- drivers/edac/ghes_edac.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-)
diff --git a/drivers/edac/ghes_edac.c b/drivers/edac/ghes_edac.c index 59b0bedc9c24..8256065b1801 100644 --- a/drivers/edac/ghes_edac.c +++ b/drivers/edac/ghes_edac.c @@ -100,12 +100,13 @@ static struct dimm_info *find_dimm_by_handle(struct mem_ctl_info *mci, u16 handl static void dimm_setup_label(struct dimm_info *dimm, u16 handle) { const char *bank = NULL, *device = NULL; + const char *na = "NA"; dmi_memdev_name(handle, &bank, &device); - /* both strings must be non-zero */ - if (bank && *bank && device && *device) - snprintf(dimm->label, sizeof(dimm->label), "%s %s", bank, device); + snprintf(dimm->label, sizeof(dimm->label), "%s %s", + (bank && *bank) ? bank : na, + (device && *device) ? device : na); } static void assign_dmi_dimm_info(struct dimm_info *dimm, struct memdev_dmi_entry *entry)
| |