From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mail.linuxfoundation.org ([140.211.169.12]:41762 "EHLO mail.linuxfoundation.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S932499AbcLMApL (ORCPT ); Mon, 12 Dec 2016 19:45:11 -0500 Subject: Patch "acpi, nfit: validate ars_status output buffer size" has been added to the 4.8-stable tree To: dan.j.williams@intel.com, gregkh@linuxfoundation.org Cc: , From: Date: Mon, 12 Dec 2016 16:45:21 -0800 Message-ID: <1481589921103165@kroah.com> MIME-Version: 1.0 Content-Type: text/plain; charset=ANSI_X3.4-1968 Content-Transfer-Encoding: 8bit Sender: stable-owner@vger.kernel.org List-ID: This is a note to let you know that I've just added the patch titled acpi, nfit: validate ars_status output buffer size to the 4.8-stable tree which can be found at: http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary The filename of the patch is: acpi-nfit-validate-ars_status-output-buffer-size.patch and it can be found in the queue-4.8 subdirectory. If you, or anyone else, feels it should not be added to the stable tree, please let know about it. >>From 82aa37cf09867c5e2c0326649d570e5b25c1189a Mon Sep 17 00:00:00 2001 From: Dan Williams Date: Tue, 6 Dec 2016 12:45:24 -0800 Subject: acpi, nfit: validate ars_status output buffer size From: Dan Williams commit 82aa37cf09867c5e2c0326649d570e5b25c1189a upstream. If an ARS Status command returns truncated output, do not process partial records or otherwise consume non-status fields. Fixes: 0caeef63e6d2 ("libnvdimm: Add a poison list and export badblocks") Signed-off-by: Dan Williams Signed-off-by: Greg Kroah-Hartman --- drivers/acpi/nfit/core.c | 21 +++++++++++++++++---- 1 file changed, 17 insertions(+), 4 deletions(-) --- a/drivers/acpi/nfit/core.c +++ b/drivers/acpi/nfit/core.c @@ -146,7 +146,8 @@ static int xlat_status(void *buf, unsign * then just continue with the returned results. */ if (status == NFIT_ARS_STATUS_INTR) { - if (ars_status->flags & NFIT_ARS_F_OVERFLOW) + if (ars_status->out_length >= 40 && (ars_status->flags + & NFIT_ARS_F_OVERFLOW)) return -ENOSPC; return 0; } @@ -1858,19 +1859,32 @@ static int ars_get_status(struct acpi_nf return cmd_rc; } -static int ars_status_process_records(struct nvdimm_bus *nvdimm_bus, +static int ars_status_process_records(struct acpi_nfit_desc *acpi_desc, struct nd_cmd_ars_status *ars_status) { + struct nvdimm_bus *nvdimm_bus = acpi_desc->nvdimm_bus; int rc; u32 i; + /* + * First record starts at 44 byte offset from the start of the + * payload. + */ + if (ars_status->out_length < 44) + return 0; for (i = 0; i < ars_status->num_records; i++) { + /* only process full records */ + if (ars_status->out_length + < 44 + sizeof(struct nd_ars_record) * (i + 1)) + break; rc = nvdimm_bus_add_poison(nvdimm_bus, ars_status->records[i].err_address, ars_status->records[i].length); if (rc) return rc; } + if (i < ars_status->num_records) + dev_warn(acpi_desc->dev, "detected truncated ars results\n"); return 0; } @@ -2123,8 +2137,7 @@ static int acpi_nfit_query_poison(struct if (rc < 0 && rc != -ENOSPC) return rc; - if (ars_status_process_records(acpi_desc->nvdimm_bus, - acpi_desc->ars_status)) + if (ars_status_process_records(acpi_desc, acpi_desc->ars_status)) return -ENOMEM; return 0; Patches currently in stable-queue which might be from dan.j.williams@intel.com are queue-4.8/acpi-nfit-validate-ars_status-output-buffer-size.patch queue-4.8/acpi-nfit-fix-extended-status-translations-for-acpi-dsms.patch queue-4.8/acpi-nfit-libnvdimm-fix-harden-ars_status-output-length-handling.patch queue-4.8/acpi-nfit-fix-bus-vs-dimm-confusion-in-xlat_status.patch queue-4.8/device-dax-fix-private-mapping-restriction-permit-read-only.patch