From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from bombadil.infradead.org (bombadil.infradead.org [198.137.202.133]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (prime256v1) server-digest SHA256) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 85F386072F8C for ; Wed, 4 Nov 2026 19:26:35 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key, unprotected) header.d=lists.infradead.org header.i=@lists.infradead.org header.a=rsa-sha256 header.s=bombadil.20210309 header.b=1d1quu4a; dkim=pass (2048-bit key, unprotected) header.d=kernel.org header.i=@kernel.org header.a=rsa-sha256 header.s=k20260515 header.b=OZmY/n0G DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.infradead.org; s=bombadil.20210309; h=Sender:List-Subscribe:List-Help :List-Post:List-Archive:List-Unsubscribe:List-Id:Content-Transfer-Encoding: Content-Type:MIME-Version:References:In-Reply-To:Message-ID:Date:Subject:Cc: To:From:Reply-To:Content-ID:Content-Description:Resent-Date:Resent-From: Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:List-Unsubscribe-Post: List-Owner; bh=KzL9ZYHhLfhD3DOSumSkk0Gb2fITAVoHxCDSq8u5ZOY=; b=1d1quu4aYRRs/C YceiODuv4/6eiphZBzHsEgU8RRSrMUEcjxbRomGY6hvJAhgUGQQBjIRH7mRj2W+r1ccd7+uZbTZlj FOwSb1fjdESVLN6Td4P92P5hLv2hqWKkscMNB93DW+ulOr3/g76CoCRyVZDpLYFfXMAfqsCW2TMLT YM4DPPPiA529OkTOusi9zuDeOQjERQLTshgPt68OPNU8OQaOMfxEiOuzAyIT5FxbsztJ3VswhdLfU WqNcQcnEL6oEke3KqdCXXSTScTfUanNFJMerIka45PqXcSc7i7Pn4/bSM1AAKmxUxcOs7yDiRdU/U JbJpovdCQoFDPAr2oaKg==; Received: from localhost ([::1] helo=bombadil.infradead.org) by bombadil.infradead.org with esmtp (Exim 4.100.1 #2 (Red Hat Linux)) id 1xOgd0-00000006cAs-3SA3; Wed, 04 Nov 2026 19:26:34 +0000 Received: from tor.source.kernel.org ([172.105.4.254]) by bombadil.infradead.org with esmtps (Exim 4.100.1 #2 (Red Hat Linux)) id 1xOgcy-00000006c9F-240s; Wed, 04 Nov 2026 19:26:32 +0000 Received: from smtp.kernel.org (quasi.space.kernel.org [100.103.45.18]) by tor.source.kernel.org (Postfix) with ESMTP id A876A60A8A; Wed, 4 Nov 2026 19:26:31 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 2A02B1F00A18; Wed, 4 Nov 2026 19:26:18 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kernel.org; s=k20260515; t=1793820391; bh=KzL9ZYHhLfhD3DOSumSkk0Gb2fITAVoHxCDSq8u5ZOY=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=OZmY/n0GXXd/waY5eO8CY5Onurst3JuvNiiWNIXcNO2ZuOFKp902BomvRAZeqhqov gVBa7tGTm8eGOA6FIqPzs+gKGb0cET9WaFFoJDGhKN+qiibaBT/bgrlsrKWepwCufy 7xbZtg/lGvVf2Z6lEc3/gKQcCopkPYa2/MYuxGe78rFjMFuwi6sASyH6Jok98Wg17F cJ/qQVE/skC9zQGR9GKwMIm//f3mEfB8/4bBi4VeRM6Lw8lfYzjOtO7fBSGQY1KnwG yl+O33qpdvuGjSLboBidD8ILci0GW1gs7UGQ/cvvcbiCIna8PYu+uszQ30CIehYMR+ tDP/eU01ohS5g== From: Christian Brauner To: linux-fsdevel@vger.kernel.org Cc: Linus Torvalds , Jann Horn , Josef Bacik , Chris Mason , Jeff Layton , NeilBrown , Eric Dumazet , Thomas Gleixner , Al Viro , Jonathan Corbet , Christoph Hellwig , Greg Kroah-Hartman , Joel Granados , Kees Cook , Jan Kara , Jan Kara , linux-kernel@vger.kernel.org, linux-nfs@vger.kernel.org, linux-acpi@vger.kernel.org, linux-kselftest@vger.kernel.org, linux-s390@vger.kernel.org, linux-scsi@vger.kernel.org, linux-um@lists.infradead.org, linux-wireless@vger.kernel.org, linuxppc-dev@lists.ozlabs.org, netdev@vger.kernel.org, ntfs3@lists.linux.dev, platform-driver-x86@vger.kernel.org, coreteam@netfilter.org, kexec@lists.infradead.org, linux-pci@vger.kernel.org, linux-sound@vger.kernel.org, netfilter-devel@vger.kernel.org, dri-devel@lists.freedesktop.org, ibm-acpi-devel@lists.sourceforge.net, jfs-discussion@lists.sourceforge.net, linux-alpha@vger.kernel.org, linux-arm-kernel@lists.infradead.org, linux-cifs@vger.kernel.org, linux-fbdev@vger.kernel.org, linux-hwmon@vger.kernel.org, linux-mm@kvack.org, linux-sh@vger.kernel.org, linux-usb@vger.kernel.org, samba-technical@lists.samba.org, sparclinux@vger.kernel.org, linux-m68k@lists.linux-m68k.org, linux-doc@vger.kernel.org, linux-serial@vger.kernel.org, linux-atm-general@lists.sourceforge.net, Takashi Iwai , linux-input@vger.kernel.org, linux-raid@vger.kernel.org, linux-ext4@vger.kernel.org, linux-modules@vger.kernel.org, linux-debuggers@vger.kernel.org, "Christian Brauner (Amutable)" , Chuck Lever , stable@vger.kernel.org Subject: [PATCH RESEND v2 42/51] powerpc/pseries: bound the lengths in the ofdt property parser Date: Wed, 4 Nov 2026 20:26:17 +0100 Message-ID: <20261104-work-procfs-bugfixes-v2-42-021c84d852e0@kernel.org> In-Reply-To: <20261104-work-procfs-bugfixes-v2-0-021c84d852e0@kernel.org> References: <20261104-work-procfs-bugfixes-v2-0-021c84d852e0@kernel.org> X-Archived-By: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" X-Mailer: b4 0.17-dev X-Developer-Signature: v=1; a=openpgp-sha256; l=4036; i=brauner@kernel.org; h=from:subject:message-id; bh=1x5L5ygLqoH4QYrbzxN55G88uXTL5wNw5UNSw5/l5lQ=; b=owGbwMvMwCU28Zj0gdSKO4sYT6slMWS9bvx/eMaUE0I+8x7uP2vLHsplqPp8Uf8cnbKLyd/ve zkpum1k6ChlYRDjYpAVU2RxaDcJl1vOU7HZKFMDZg4rE8gQBi5OAZjIciOGfwpWqRcLVdK6Yk+U 7Mjin33JpmbO+9ppHJaBzs+t3kx9ZcXwV37rzQebpE0czPNr1/Zo75BRluja0J3FW2zd03c/onQ XAwA= X-Developer-Key: i=brauner@kernel.org; a=openpgp; fpr=4880B8C9BD0E5106FC070F4F7B3C391EFEA93624 Content-Transfer-Encoding: 8bit X-BeenThere: linux-um@lists.infradead.org X-Mailman-Version: 2.1.34 Precedence: list List-Id: List-Archive: List-Post: List-Help: List-Subscribe: , Sender: "linux-um" X-Spam-Status: No, score=-18.9 required=3.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF, HEADER_FROM_DIFFERENT_DOMAINS,INCLUDES_CR_TRAILER,INCLUDES_PATCH, MAILING_LIST_MULTI,SPF_HELO_NONE,SPF_PASS,USER_AGENT_GIT autolearn=unavailable autolearn_force=no version=4.0.1 X-Spam-Checker-Version: SpamAssassin 4.0.1 (2024-03-26) on aws-us-west-2-korg-listserv-alma10-1 The commands for /proc/powerpc/ofdt that carry properties, "add_node", "add_property" and "update_property", can make the parser read past the buffer they were copied into: (1) do_update_property() computes the end of the buffer after parse_node() moved buf past the phandle. So the end is off by the length of the phandle string, which can be padded with zeroes, and parse_next_property() accepts a value that reaches that far past the command. new_property() then copies those bytes into the property, which everyone can read in /proc/device-tree. (2) parse_next_property() parses the length with simple_strtoul() into an int and only rejects -1. A length above INT_MAX turns negative, tmp += *length moves backwards and passes the check against the end, so *tmp is read up to 2G in front of the buffer. (3) Updating "slb-size" or "ibm,slb-size" reads an int from the value whatever its length. Compute the end before parsing the phandle, reject lengths that don't fit into an int or into what is left of the buffer, and only take the slb size from a value that holds one. The file is root-only and refused under lockdown but the parser still shouldn't read past its input. Reported-by: Chris Mason Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Fixes: 610d91511f99 ("[PATCH] powerpc: Add support for changing properties from userspace") Fixes: 46db2f86a3b2 ("powerpc/pseries: Fix to handle slb resize across migration") Cc: stable@vger.kernel.org Signed-off-by: Christian Brauner (Amutable) --- arch/powerpc/platforms/pseries/reconfig.c | 18 ++++++++++-------- 1 file changed, 10 insertions(+), 8 deletions(-) diff --git a/arch/powerpc/platforms/pseries/reconfig.c b/arch/powerpc/platforms/pseries/reconfig.c index 5a0c9c0b6253..b543afbc1efb 100644 --- a/arch/powerpc/platforms/pseries/reconfig.c +++ b/arch/powerpc/platforms/pseries/reconfig.c @@ -114,6 +114,7 @@ static void release_prop_list(const struct property *prop) static char * parse_next_property(char *buf, char *end, char **name, int *length, unsigned char **value) { + unsigned long len; char *tmp; *name = buf; @@ -133,13 +134,13 @@ static char * parse_next_property(char *buf, char *end, char **name, int *length } /* now we're on the length */ - *length = -1; - *length = simple_strtoul(tmp, &tmp, 10); - if (*length == -1) { + len = simple_strtoul(tmp, &tmp, 10); + if (len > INT_MAX) { printk(KERN_ERR "property parse failed in %s at line %d\n", __func__, __LINE__); return NULL; } + *length = len; if (*tmp != ' ' || ++tmp >= end) { printk(KERN_ERR "property parse failed in %s at line %d\n", __func__, __LINE__); @@ -148,13 +149,13 @@ static char * parse_next_property(char *buf, char *end, char **name, int *length /* now we're on the value */ *value = tmp; - tmp += *length; - if (tmp > end) { + if (len > end - tmp) { printk(KERN_ERR "property parse failed in %s at line %d\n", __func__, __LINE__); return NULL; } - else if (tmp < end && *tmp != ' ' && *tmp != '\0') { + tmp += len; + if (tmp < end && *tmp != ' ' && *tmp != '\0') { printk(KERN_ERR "property parse failed in %s at line %d\n", __func__, __LINE__); return NULL; @@ -320,8 +321,8 @@ static int do_update_property(char *buf, size_t bufsize) char *name, *end, *next_prop; int length; struct property *newprop; - buf = parse_node(buf, bufsize, &np); end = buf + bufsize; + buf = parse_node(buf, bufsize, &np); if (!np) return -ENODEV; @@ -337,7 +338,8 @@ static int do_update_property(char *buf, size_t bufsize) if (!newprop) return -ENOMEM; - if (!strcmp(name, "slb-size") || !strcmp(name, "ibm,slb-size")) + if ((!strcmp(name, "slb-size") || !strcmp(name, "ibm,slb-size")) && + length >= (int)sizeof(int)) slb_set_size(*(int *)value); return of_update_property(np, newprop); -- 2.53.0