All of lore.kernel.org
 help / color / mirror / Atom feed
From: Toshi Kani <toshi.kani@hpe.com>
To: bp@alien8.de, rric@kernel.org, mchehab@kernel.org
Cc: toshi.kani@hpe.com, elliott@hpe.com, linux-edac@vger.kernel.org,
	linux-kernel@vger.kernel.org
Subject: [PATCH v3] EDAC/ghes: Set the DIMM label unconditionally
Date: Tue, 26 Jul 2022 10:46:28 -0600	[thread overview]
Message-ID: <20220726164628.1756924-1-toshi.kani@hpe.com> (raw)

The following buffer overflow BUG was observed on an HPE system.
ghes_edac_register() called strlen() on an uninitialized label,
which had non-zero values from krealloc_array().

  detected buffer overflow in __fortify_strlen
   ------------[ cut here ]------------
   kernel BUG at lib/string_helpers.c:983!
   invalid opcode: 0000 [#1] PREEMPT SMP NOPTI
   CPU: 1 PID: 1 Comm: swapper/0 Tainted: G          I       5.18.6-200.fc36.x86_64 #1
   Hardware name: HPE ProLiant DL360 Gen10/ProLiant DL360 Gen10, BIOS U32 03/15/2019
   RIP: 0010:fortify_panic
   ...
   Call Trace:
    <TASK>
    ghes_edac_register.cold
    ghes_probe
    platform_probe
    really_probe
    __driver_probe_device
    driver_probe_device
    __driver_attach
    ? __device_attach_driver
    bus_for_each_dev
    bus_add_driver
    driver_register
    acpi_ghes_init
    acpi_init
    ? acpi_sleep_proc_init
    do_one_initcall

dimm_setup_label() only initializes the label when both bank and
device are set.  This HPE BIOS only sets device since bank locator
is unnecessary to locate a DIMM.

  Handle 0x0020, DMI type 17, 84 bytes
  Memory Device
          Array Handle: 0x0013
          Error Information Handle: Not Provided
          Total Width: 72 bits
          Data Width: 64 bits
          Size: 32 GB
          Form Factor: DIMM
          Set: None
          Locator: PROC 1 DIMM 1        <=== device
          Bank Locator: Not Specified   <=== bank

Change dimm_setup_label() to always initialize the label to fix the
issue.  It sets to a null string in case BIOS does not provide both
bank and device so that ghes_edac_register() keeps the default label
from edac_mc_alloc_dimms().

Fixes: b9cae27728d1f ("EDAC/ghes: Scan the system once on driver init")
Signed-off-by: Toshi Kani <toshi.kani@hpe.com>
Co-developed-by: Robert Richter <rric@kernel.org>
Tested-by: Robert Elliott <elliott@hpe.com>
---
 drivers/edac/ghes_edac.c |   12 +++++++++---
 1 file changed, 9 insertions(+), 3 deletions(-)

diff --git a/drivers/edac/ghes_edac.c b/drivers/edac/ghes_edac.c
index 59b0bedc9c24..c229ed0ce678 100644
--- a/drivers/edac/ghes_edac.c
+++ b/drivers/edac/ghes_edac.c
@@ -103,9 +103,15 @@ static void dimm_setup_label(struct dimm_info *dimm, u16 handle)
 
 	dmi_memdev_name(handle, &bank, &device);
 
-	/* both strings must be non-zero */
-	if (bank && *bank && device && *device)
-		snprintf(dimm->label, sizeof(dimm->label), "%s %s", bank, device);
+	/* 
+	 * Set a null string when both bank and device are zero.
+	 * This keeps ghes_edac_register() preserving the default
+	 * label from edac_mc_alloc_dimms().
+	 */
+	snprintf(dimm->label, sizeof(dimm->label), "%s%s%s",
+			(bank && *bank) ? bank : "",
+			(bank && *bank && device && *device) ? " " : "",
+			(device && *device) ? device : "");
 }
 
 static void assign_dmi_dimm_info(struct dimm_info *dimm, struct memdev_dmi_entry *entry)

             reply	other threads:[~2022-07-26 16:46 UTC|newest]

Thread overview: 2+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2022-07-26 16:46 Toshi Kani [this message]
2022-07-27  8:45 ` [PATCH v3] EDAC/ghes: Set the DIMM label unconditionally Borislav Petkov

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20220726164628.1756924-1-toshi.kani@hpe.com \
    --to=toshi.kani@hpe.com \
    --cc=bp@alien8.de \
    --cc=elliott@hpe.com \
    --cc=linux-edac@vger.kernel.org \
    --cc=linux-kernel@vger.kernel.org \
    --cc=mchehab@kernel.org \
    --cc=rric@kernel.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.