lkml.org 
[lkml]   [2022]   [Aug]   [1]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 5.15 66/69] EDAC/ghes: Set the DIMM label unconditionally
    Date
    From: Toshi Kani <toshi.kani@hpe.com>

    commit 5e2805d5379619c4a2e3ae4994e73b36439f4bad upstream.

    The commit

    cb51a371d08e ("EDAC/ghes: Setup DIMM label from DMI and use it in error reports")

    enforced that both the bank and device strings passed to
    dimm_setup_label() are not NULL.

    However, there are BIOSes, for example on a

    HPE ProLiant DL360 Gen10/ProLiant DL360 Gen10, BIOS U32 03/15/2019

    which don't populate both strings:

    Handle 0x0020, DMI type 17, 84 bytes
    Memory Device
    Array Handle: 0x0013
    Error Information Handle: Not Provided
    Total Width: 72 bits
    Data Width: 64 bits
    Size: 32 GB
    Form Factor: DIMM
    Set: None
    Locator: PROC 1 DIMM 1 <===== device
    Bank Locator: Not Specified <===== bank

    This results in a buffer overflow because ghes_edac_register() calls
    strlen() on an uninitialized label, which had non-zero values left over
    from krealloc_array():

    detected buffer overflow in __fortify_strlen
    ------------[ cut here ]------------
    kernel BUG at lib/string_helpers.c:983!
    invalid opcode: 0000 [#1] PREEMPT SMP NOPTI
    CPU: 1 PID: 1 Comm: swapper/0 Tainted: G I 5.18.6-200.fc36.x86_64 #1
    Hardware name: HPE ProLiant DL360 Gen10/ProLiant DL360 Gen10, BIOS U32 03/15/2019
    RIP: 0010:fortify_panic
    ...
    Call Trace:
    <TASK>
    ghes_edac_register.cold
    ghes_probe
    platform_probe
    really_probe
    __driver_probe_device
    driver_probe_device
    __driver_attach
    ? __device_attach_driver
    bus_for_each_dev
    bus_add_driver
    driver_register
    acpi_ghes_init
    acpi_init
    ? acpi_sleep_proc_init
    do_one_initcall

    The label contains garbage because the commit in Fixes reallocs the
    DIMMs array while scanning the system but doesn't clear the newly
    allocated memory.

    Change dimm_setup_label() to always initialize the label to fix the
    issue. Set it to the empty string in case BIOS does not provide both
    bank and device so that ghes_edac_register() can keep the default label
    given by edac_mc_alloc_dimms().

    [ bp: Rewrite commit message. ]

    Fixes: b9cae27728d1f ("EDAC/ghes: Scan the system once on driver init")
    Co-developed-by: Robert Richter <rric@kernel.org>
    Signed-off-by: Robert Richter <rric@kernel.org>
    Signed-off-by: Toshi Kani <toshi.kani@hpe.com>
    Signed-off-by: Borislav Petkov <bp@suse.de>
    Tested-by: Robert Elliott <elliott@hpe.com>
    Cc: <stable@vger.kernel.org>
    Link: https://lore.kernel.org/r/20220719220124.760359-1-toshi.kani@hpe.com
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    ---
    drivers/edac/ghes_edac.c | 11 ++++++++---
    1 file changed, 8 insertions(+), 3 deletions(-)

    --- a/drivers/edac/ghes_edac.c
    +++ b/drivers/edac/ghes_edac.c
    @@ -101,9 +101,14 @@ static void dimm_setup_label(struct dimm

    dmi_memdev_name(handle, &bank, &device);

    - /* both strings must be non-zero */
    - if (bank && *bank && device && *device)
    - snprintf(dimm->label, sizeof(dimm->label), "%s %s", bank, device);
    + /*
    + * Set to a NULL string when both bank and device are zero. In this case,
    + * the label assigned by default will be preserved.
    + */
    + snprintf(dimm->label, sizeof(dimm->label), "%s%s%s",
    + (bank && *bank) ? bank : "",
    + (bank && *bank && device && *device) ? " " : "",
    + (device && *device) ? device : "");
    }

    static void assign_dmi_dimm_info(struct dimm_info *dimm, struct memdev_dmi_entry *entry)

    \
     
     \ /
      Last update: 2022-08-01 14:10    [W:4.324 / U:0.008 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site