[PATCH] EDAC/ghes: Fix buffer overflow in ghes_edac_register()

Toshi Kani
2022-07-19T22:01:55Z

The following buffer overflow BUG was observed on an HPE system.
ghes_edac_register() called strlen() on an uninitialized label,
which had non-zero values from krealloc_array().
Change dimm_setup_label() to always initialize the label.

detected buffer overflow in __fortify_strlen
------------[ cut here ]------------
kernel BUG at lib/string_helpers.c:983!
invalid opcode: 0000 [#1] PREEMPT SMP NOPTI
CPU: 1 PID: 1 Comm: swapper/0 Tainted: G I 5.18.6-200.fc36.x86_64 #1
Hardware name: HPE ProLiant DL360 Gen10/ProLiant DL360 Gen10, BIOS U32 03/15/2019
RIP: 0010:fortify_panic+0xf/0x11
...
Call Trace:
<TASK>
ghes_edac_register.cold+0x128/0x128
ghes_probe+0x142/0x3a0
platform_probe+0x41/0x90
really_probe+0x19e/0x370
__driver_probe_device+0xfc/0x170
driver_probe_device+0x1f/0x90
__driver_attach+0xbb/0x190
? __device_attach_driver+0xe0/0xe0
bus_for_each_dev+0x5f/0x90
bus_add_driver+0x159/0x200
driver_register+0x89/0xd0
acpi_ghes_init+0x72/0xc3
acpi_init+0x441/0x493
? acpi_sleep_proc_init+0x24/0x24
do_one_initcall+0x41/0x200

Fixes: b9cae27728d1f ("EDAC/ghes: Scan the system once on driver init")
Tested-by: Robert Elliott <elliott@hpe.com>
Signed-off-by: Toshi Kani <toshi.kani@hpe.com>
Cc: Robert Richter <rrichter@marvell.com>
Cc: Borislav Petkov <bp@suse.de>
Cc: Mauro Carvalho Chehab <mchehab@kernel.org>
---
drivers/edac/ghes_edac.c | 2 ++
1 file changed, 2 insertions(+)

diff --git a/drivers/edac/ghes_edac.c b/drivers/edac/ghes_edac.c
index 59b0bedc9c24..3ad3d5fc45e0 100644
--- a/drivers/edac/ghes_edac.c
+++ b/drivers/edac/ghes_edac.c
@@ -106,6 +106,8 @@ static void dimm_setup_label(struct dimm_info *dimm, u16 handle)
/* both strings must be non-zero */
if (bank && *bank && device && *device)
snprintf(dimm->label, sizeof(dimm->label), "%s %s", bank, device);
+ else
+ dimm->label[0] = '\0';
}

static void assign_dmi_dimm_info(struct dimm_info *dimm, struct memdev_dmi_entry *entry)