From: Toshi Kani <toshi.kani@hpe.com>
To: bp@alien8.de, rric@kernel.org, mchehab@kernel.org
Cc: toshi.kani@hpe.com, elliott@hpe.com, linux-edac@vger.kernel.org,
linux-kernel@vger.kernel.org
Subject: [PATCH v3] EDAC/ghes: Set the DIMM label unconditionally
Date: Tue, 26 Jul 2022 10:46:28 -0600 [thread overview]
Message-ID: <20220726164628.1756924-1-toshi.kani@hpe.com> (raw)
The following buffer overflow BUG was observed on an HPE system.
ghes_edac_register() called strlen() on an uninitialized label,
which had non-zero values from krealloc_array().
detected buffer overflow in __fortify_strlen
------------[ cut here ]------------
kernel BUG at lib/string_helpers.c:983!
invalid opcode: 0000 [#1] PREEMPT SMP NOPTI
CPU: 1 PID: 1 Comm: swapper/0 Tainted: G I 5.18.6-200.fc36.x86_64 #1
Hardware name: HPE ProLiant DL360 Gen10/ProLiant DL360 Gen10, BIOS U32 03/15/2019
RIP: 0010:fortify_panic
...
Call Trace:
<TASK>
ghes_edac_register.cold
ghes_probe
platform_probe
really_probe
__driver_probe_device
driver_probe_device
__driver_attach
? __device_attach_driver
bus_for_each_dev
bus_add_driver
driver_register
acpi_ghes_init
acpi_init
? acpi_sleep_proc_init
do_one_initcall
dimm_setup_label() only initializes the label when both bank and
device are set. This HPE BIOS only sets device since bank locator
is unnecessary to locate a DIMM.
Handle 0x0020, DMI type 17, 84 bytes
Memory Device
Array Handle: 0x0013
Error Information Handle: Not Provided
Total Width: 72 bits
Data Width: 64 bits
Size: 32 GB
Form Factor: DIMM
Set: None
Locator: PROC 1 DIMM 1 <=== device
Bank Locator: Not Specified <=== bank
Change dimm_setup_label() to always initialize the label to fix the
issue. It sets to a null string in case BIOS does not provide both
bank and device so that ghes_edac_register() keeps the default label
from edac_mc_alloc_dimms().
Fixes: b9cae27728d1f ("EDAC/ghes: Scan the system once on driver init")
Signed-off-by: Toshi Kani <toshi.kani@hpe.com>
Co-developed-by: Robert Richter <rric@kernel.org>
Tested-by: Robert Elliott <elliott@hpe.com>
---
drivers/edac/ghes_edac.c | 12 +++++++++---
1 file changed, 9 insertions(+), 3 deletions(-)
diff --git a/drivers/edac/ghes_edac.c b/drivers/edac/ghes_edac.c
index 59b0bedc9c24..c229ed0ce678 100644
--- a/drivers/edac/ghes_edac.c
+++ b/drivers/edac/ghes_edac.c
@@ -103,9 +103,15 @@ static void dimm_setup_label(struct dimm_info *dimm, u16 handle)
dmi_memdev_name(handle, &bank, &device);
- /* both strings must be non-zero */
- if (bank && *bank && device && *device)
- snprintf(dimm->label, sizeof(dimm->label), "%s %s", bank, device);
+ /*
+ * Set a null string when both bank and device are zero.
+ * This keeps ghes_edac_register() preserving the default
+ * label from edac_mc_alloc_dimms().
+ */
+ snprintf(dimm->label, sizeof(dimm->label), "%s%s%s",
+ (bank && *bank) ? bank : "",
+ (bank && *bank && device && *device) ? " " : "",
+ (device && *device) ? device : "");
}
static void assign_dmi_dimm_info(struct dimm_info *dimm, struct memdev_dmi_entry *entry)
next reply other threads:[~2022-07-26 16:46 UTC|newest]
Thread overview: 2+ messages / expand[flat|nested] mbox.gz Atom feed top
2022-07-26 16:46 Toshi Kani [this message]
2022-07-27 8:45 ` [PATCH v3] EDAC/ghes: Set the DIMM label unconditionally Borislav Petkov
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20220726164628.1756924-1-toshi.kani@hpe.com \
--to=toshi.kani@hpe.com \
--cc=bp@alien8.de \
--cc=elliott@hpe.com \
--cc=linux-edac@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=mchehab@kernel.org \
--cc=rric@kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.