From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mail-dm3nam03on0106.outbound.protection.outlook.com ([104.47.41.106]:53120 "EHLO NAM03-DM3-obe.outbound.protection.outlook.com" rhost-flags-OK-OK-OK-FAIL) by vger.kernel.org with ESMTP id S1727336AbeH3WMH (ORCPT ); Thu, 30 Aug 2018 18:12:07 -0400 From: Sasha Levin To: "stable@vger.kernel.org" CC: Mahesh Salgaonkar , Michael Ellerman , Sasha Levin Subject: [PATCH AUTOSEL 4.18 098/113] powerpc/pseries: Avoid using the size greater than RTAS_ERROR_LOG_MAX. Date: Thu, 30 Aug 2018 18:08:15 +0000 Message-ID: <20180830180714.36167-32-alexander.levin@microsoft.com> References: <20180830180714.36167-1-alexander.levin@microsoft.com> In-Reply-To: <20180830180714.36167-1-alexander.levin@microsoft.com> Content-Language: en-US Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 Sender: stable-owner@vger.kernel.org List-ID: From: Mahesh Salgaonkar [ Upstream commit 74e96bf44f430cf7a01de19ba6cf49b361cdfd6e ] The global mce data buffer that used to copy rtas error log is of 2048 (RTAS_ERROR_LOG_MAX) bytes in size. Before the copy we read extended_log_length from rtas error log header, then use max of extended_log_length and RTAS_ERROR_LOG_MAX as a size of data to be copied. Ideally the platform (phyp) will never send extended error log with size > 2048. But if that happens, then we have a risk of buffer overrun and corruption. Fix this by using min_t instead. Fixes: d368514c3097 ("powerpc: Fix corruption when grabbing FWNMI data") Reported-by: Michal Suchanek Signed-off-by: Mahesh Salgaonkar Signed-off-by: Michael Ellerman Signed-off-by: Sasha Levin --- arch/powerpc/platforms/pseries/ras.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/arch/powerpc/platforms/pseries/ras.c b/arch/powerpc/platforms/= pseries/ras.c index 5e1ef9150182..ef104144d4bc 100644 --- a/arch/powerpc/platforms/pseries/ras.c +++ b/arch/powerpc/platforms/pseries/ras.c @@ -371,7 +371,7 @@ static struct rtas_error_log *fwnmi_get_errinfo(struct = pt_regs *regs) int len, error_log_length; =20 error_log_length =3D 8 + rtas_error_extended_log_length(h); - len =3D max_t(int, error_log_length, RTAS_ERROR_LOG_MAX); + len =3D min_t(int, error_log_length, RTAS_ERROR_LOG_MAX); memset(global_mce_data_buf, 0, RTAS_ERROR_LOG_MAX); memcpy(global_mce_data_buf, h, len); errhdr =3D (struct rtas_error_log *)global_mce_data_buf; --=20 2.17.1