* [PATCH] pstore: skip zero size persistent ram buffer in traverse
@ 2014-02-28 6:38 shuox.liu
2014-03-02 9:06 ` Zhang, Yanmin
2014-03-03 19:46 ` Kees Cook
0 siblings, 2 replies; 3+ messages in thread
From: shuox.liu @ 2014-02-28 6:38 UTC (permalink / raw)
To: linux-kernel; +Cc: tony.luck, keescook, ccross, anton, yanmin_zhang
From: Liu ShuoX <shuox.liu@intel.com>
In ramoops_pstore_read, a valid prz pointer with zero size buffer will
break traverse of all persistent ram buffers. The latter buffer might
be lost.
Signed-off-by: Liu ShuoX <shuox.liu@intel.com>
---
fs/pstore/ram.c | 10 +++++-----
1 file changed, 5 insertions(+), 5 deletions(-)
diff --git a/fs/pstore/ram.c b/fs/pstore/ram.c
index a5d0cab..929ea55 100644
--- a/fs/pstore/ram.c
+++ b/fs/pstore/ram.c
@@ -119,12 +119,12 @@ ramoops_get_next_prz(struct persistent_ram_zone *przs[], uint *c, uint max,
prz = przs[i];
- if (update) {
- /* Update old/shadowed buffer. */
+ /* Update old/shadowed buffer. */
+ if (update)
persistent_ram_save_old(prz);
- if (!persistent_ram_old_size(prz))
- return NULL;
- }
+
+ if (!persistent_ram_old_size(prz))
+ return NULL;
*typep = type;
*id = i;
--
1.8.3.2
^ permalink raw reply related [flat|nested] 3+ messages in thread
* Re: [PATCH] pstore: skip zero size persistent ram buffer in traverse
2014-02-28 6:38 [PATCH] pstore: skip zero size persistent ram buffer in traverse shuox.liu
@ 2014-03-02 9:06 ` Zhang, Yanmin
2014-03-03 19:46 ` Kees Cook
1 sibling, 0 replies; 3+ messages in thread
From: Zhang, Yanmin @ 2014-03-02 9:06 UTC (permalink / raw)
To: shuox.liu, linux-kernel, akpm; +Cc: tony.luck, keescook, ccross, anton
On 2014/2/28 14:38, shuox.liu@intel.com wrote:
> From: Liu ShuoX <shuox.liu@intel.com>
>
> In ramoops_pstore_read, a valid prz pointer with zero size buffer will
> break traverse of all persistent ram buffers. The latter buffer might
> be lost.
Andrew,
Would you like to merge it to your testing tree?
pstore is a very important feature for debugging hard issues on
Android mobiles.
Yanmin
>
> Signed-off-by: Liu ShuoX <shuox.liu@intel.com>
> ---
> fs/pstore/ram.c | 10 +++++-----
> 1 file changed, 5 insertions(+), 5 deletions(-)
>
> diff --git a/fs/pstore/ram.c b/fs/pstore/ram.c
> index a5d0cab..929ea55 100644
> --- a/fs/pstore/ram.c
> +++ b/fs/pstore/ram.c
> @@ -119,12 +119,12 @@ ramoops_get_next_prz(struct persistent_ram_zone *przs[], uint *c, uint max,
>
> prz = przs[i];
>
> - if (update) {
> - /* Update old/shadowed buffer. */
> + /* Update old/shadowed buffer. */
> + if (update)
> persistent_ram_save_old(prz);
> - if (!persistent_ram_old_size(prz))
> - return NULL;
> - }
> +
> + if (!persistent_ram_old_size(prz))
> + return NULL;
>
> *typep = type;
> *id = i;
^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: [PATCH] pstore: skip zero size persistent ram buffer in traverse
2014-02-28 6:38 [PATCH] pstore: skip zero size persistent ram buffer in traverse shuox.liu
2014-03-02 9:06 ` Zhang, Yanmin
@ 2014-03-03 19:46 ` Kees Cook
1 sibling, 0 replies; 3+ messages in thread
From: Kees Cook @ 2014-03-03 19:46 UTC (permalink / raw)
To: shuox.liu; +Cc: LKML, Tony Luck, Colin Cross, Anton Vorontsov, yanmin_zhang
On Thu, Feb 27, 2014 at 10:38 PM, <shuox.liu@intel.com> wrote:
> From: Liu ShuoX <shuox.liu@intel.com>
>
> In ramoops_pstore_read, a valid prz pointer with zero size buffer will
> break traverse of all persistent ram buffers. The latter buffer might
> be lost.
>
> Signed-off-by: Liu ShuoX <shuox.liu@intel.com>
> ---
> fs/pstore/ram.c | 10 +++++-----
> 1 file changed, 5 insertions(+), 5 deletions(-)
>
> diff --git a/fs/pstore/ram.c b/fs/pstore/ram.c
> index a5d0cab..929ea55 100644
> --- a/fs/pstore/ram.c
> +++ b/fs/pstore/ram.c
> @@ -119,12 +119,12 @@ ramoops_get_next_prz(struct persistent_ram_zone *przs[], uint *c, uint max,
>
> prz = przs[i];
>
> - if (update) {
> - /* Update old/shadowed buffer. */
> + /* Update old/shadowed buffer. */
> + if (update)
> persistent_ram_save_old(prz);
> - if (!persistent_ram_old_size(prz))
> - return NULL;
> - }
> +
> + if (!persistent_ram_old_size(prz))
> + return NULL;
>
> *typep = type;
> *id = i;
Good catch; this change makes sense to me.
Reviewed-by: Kees Cook <keescook@chromium.org>
-Kees
--
Kees Cook
Chrome OS Security
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2014-03-03 19:46 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2014-02-28 6:38 [PATCH] pstore: skip zero size persistent ram buffer in traverse shuox.liu
2014-03-02 9:06 ` Zhang, Yanmin
2014-03-03 19:46 ` Kees Cook
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox