public inbox for linux-edac@vger.kernel.org
 help / color / mirror / Atom feed
From: Toshi Kani <toshi.kani@hpe.com>
To: bp@alien8.de, rrichter@marvell.com, mchehab@kernel.org
Cc: toshi.kani@hpe.com, elliott@hpe.com, linux-edac@vger.kernel.org,
	linux-kernel@vger.kernel.org, Borislav Petkov <bp@suse.de>
Subject: [PATCH] EDAC/ghes: Fix buffer overflow in ghes_edac_register()
Date: Tue, 19 Jul 2022 16:01:24 -0600	[thread overview]
Message-ID: <20220719220124.760359-1-toshi.kani@hpe.com> (raw)

The following buffer overflow BUG was observed on an HPE system.
ghes_edac_register() called strlen() on an uninitialized label,
which had non-zero values from krealloc_array().
Change dimm_setup_label() to always initialize the label.

 detected buffer overflow in __fortify_strlen
 ------------[ cut here ]------------
 kernel BUG at lib/string_helpers.c:983!
 invalid opcode: 0000 [#1] PREEMPT SMP NOPTI
 CPU: 1 PID: 1 Comm: swapper/0 Tainted: G          I       5.18.6-200.fc36.x86_64 #1
 Hardware name: HPE ProLiant DL360 Gen10/ProLiant DL360 Gen10, BIOS U32 03/15/2019
 RIP: 0010:fortify_panic+0xf/0x11
 ...
 Call Trace:
  <TASK>
  ghes_edac_register.cold+0x128/0x128
  ghes_probe+0x142/0x3a0
  platform_probe+0x41/0x90
  really_probe+0x19e/0x370
  __driver_probe_device+0xfc/0x170
  driver_probe_device+0x1f/0x90
  __driver_attach+0xbb/0x190
  ? __device_attach_driver+0xe0/0xe0
  bus_for_each_dev+0x5f/0x90
  bus_add_driver+0x159/0x200
  driver_register+0x89/0xd0
  acpi_ghes_init+0x72/0xc3
  acpi_init+0x441/0x493
  ? acpi_sleep_proc_init+0x24/0x24
  do_one_initcall+0x41/0x200

Fixes: b9cae27728d1f ("EDAC/ghes: Scan the system once on driver init")
Tested-by: Robert Elliott <elliott@hpe.com>
Signed-off-by: Toshi Kani <toshi.kani@hpe.com>
Cc: Robert Richter <rrichter@marvell.com>
Cc: Borislav Petkov <bp@suse.de>
Cc: Mauro Carvalho Chehab <mchehab@kernel.org>
---
 drivers/edac/ghes_edac.c |    2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/edac/ghes_edac.c b/drivers/edac/ghes_edac.c
index 59b0bedc9c24..3ad3d5fc45e0 100644
--- a/drivers/edac/ghes_edac.c
+++ b/drivers/edac/ghes_edac.c
@@ -106,6 +106,8 @@ static void dimm_setup_label(struct dimm_info *dimm, u16 handle)
 	/* both strings must be non-zero */
 	if (bank && *bank && device && *device)
 		snprintf(dimm->label, sizeof(dimm->label), "%s %s", bank, device);
+	else
+		dimm->label[0] = '\0';
 }
 
 static void assign_dmi_dimm_info(struct dimm_info *dimm, struct memdev_dmi_entry *entry)

             reply	other threads:[~2022-07-19 22:01 UTC|newest]

Thread overview: 5+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2022-07-19 22:01 Toshi Kani [this message]
2022-07-20 11:51 ` [PATCH] EDAC/ghes: Fix buffer overflow in ghes_edac_register() Borislav Petkov
2022-07-20 15:41   ` Kani, Toshi
2022-07-20 15:57     ` Borislav Petkov
2022-07-20 16:17       ` Kani, Toshi

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20220719220124.760359-1-toshi.kani@hpe.com \
    --to=toshi.kani@hpe.com \
    --cc=bp@alien8.de \
    --cc=bp@suse.de \
    --cc=elliott@hpe.com \
    --cc=linux-edac@vger.kernel.org \
    --cc=linux-kernel@vger.kernel.org \
    --cc=mchehab@kernel.org \
    --cc=rrichter@marvell.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox