* FAILED: patch "[PATCH] s390/ipl: add missing intersection check to ipl_report" failed to apply to 5.10-stable tree
@ 2023-03-20 9:18 gregkh
2023-03-20 10:32 ` [PATCH 5.10.y] s390/ipl: add missing intersection check to ipl_report handling Sven Schnelle
0 siblings, 1 reply; 3+ messages in thread
From: gregkh @ 2023-03-20 9:18 UTC (permalink / raw)
To: svens, gor, stable; +Cc: stable
The patch below does not apply to the 5.10-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable@vger.kernel.org>.
To reproduce the conflict and resubmit, you may use the following commands:
git fetch https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ linux-5.10.y
git checkout FETCH_HEAD
git cherry-pick -x a52e5cdbe8016d4e3e6322fd93d71afddb9a5af9
# <resolve conflicts, build, test, etc.>
git commit -s
git send-email --to '<stable@vger.kernel.org>' --in-reply-to '16793039081369@kroah.com' --subject-prefix 'PATCH 5.10.y' HEAD^..
Possible dependencies:
a52e5cdbe801 ("s390/ipl: add missing intersection check to ipl_report handling")
84733284f67b ("s390/boot: introduce boot data 'initrd_data'")
9f744abb4639 ("s390/boot: replace magic string check with a bootdata flag")
73045a08cf55 ("s390: unify identity mapping limits handling")
d7e7fbba67a3 ("s390/early: rewrite program parameter setup in C")
0c4ec024a481 ("s390/kasan: move memory needs estimation into a function")
92bca2fe61f5 ("s390/kasan: avoid confusing naming")
90178c190079 ("s390/mm: let vmalloc area size depend on physical memory size")
a3453d923ece ("s390/kasan: remove 3-level paging support")
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
From a52e5cdbe8016d4e3e6322fd93d71afddb9a5af9 Mon Sep 17 00:00:00 2001
From: Sven Schnelle <svens@linux.ibm.com>
Date: Tue, 7 Mar 2023 14:35:23 +0100
Subject: [PATCH] s390/ipl: add missing intersection check to ipl_report
handling
The code which handles the ipl report is searching for a free location
in memory where it could copy the component and certificate entries to.
It checks for intersection between the sections required for the kernel
and the component/certificate data area, but fails to check whether
the data structures linking these data areas together intersect.
This might cause the iplreport copy code to overwrite the iplreport
itself. Fix this by adding two addtional intersection checks.
Cc: <stable@vger.kernel.org>
Fixes: 9641b8cc733f ("s390/ipl: read IPL report at early boot")
Signed-off-by: Sven Schnelle <svens@linux.ibm.com>
Reviewed-by: Vasily Gorbik <gor@linux.ibm.com>
Signed-off-by: Vasily Gorbik <gor@linux.ibm.com>
diff --git a/arch/s390/boot/ipl_report.c b/arch/s390/boot/ipl_report.c
index 9b14045065b6..74b5cd264862 100644
--- a/arch/s390/boot/ipl_report.c
+++ b/arch/s390/boot/ipl_report.c
@@ -57,11 +57,19 @@ static unsigned long find_bootdata_space(struct ipl_rb_components *comps,
if (IS_ENABLED(CONFIG_BLK_DEV_INITRD) && initrd_data.start && initrd_data.size &&
intersects(initrd_data.start, initrd_data.size, safe_addr, size))
safe_addr = initrd_data.start + initrd_data.size;
+ if (intersects(safe_addr, size, (unsigned long)comps, comps->len)) {
+ safe_addr = (unsigned long)comps + comps->len;
+ goto repeat;
+ }
for_each_rb_entry(comp, comps)
if (intersects(safe_addr, size, comp->addr, comp->len)) {
safe_addr = comp->addr + comp->len;
goto repeat;
}
+ if (intersects(safe_addr, size, (unsigned long)certs, certs->len)) {
+ safe_addr = (unsigned long)certs + certs->len;
+ goto repeat;
+ }
for_each_rb_entry(cert, certs)
if (intersects(safe_addr, size, cert->addr, cert->len)) {
safe_addr = cert->addr + cert->len;
^ permalink raw reply related [flat|nested] 3+ messages in thread
* [PATCH 5.10.y] s390/ipl: add missing intersection check to ipl_report handling
2023-03-20 9:18 FAILED: patch "[PATCH] s390/ipl: add missing intersection check to ipl_report" failed to apply to 5.10-stable tree gregkh
@ 2023-03-20 10:32 ` Sven Schnelle
2023-03-20 13:33 ` Greg KH
0 siblings, 1 reply; 3+ messages in thread
From: Sven Schnelle @ 2023-03-20 10:32 UTC (permalink / raw)
To: stable; +Cc: gor
The code which handles the ipl report is searching for a free location
in memory where it could copy the component and certificate entries to.
It checks for intersection between the sections required for the kernel
and the component/certificate data area, but fails to check whether
the data structures linking these data areas together intersect.
This might cause the iplreport copy code to overwrite the iplreport
itself. Fix this by adding two addtional intersection checks.
Cc: <stable@vger.kernel.org>
Fixes: 9641b8cc733f ("s390/ipl: read IPL report at early boot")
Signed-off-by: Sven Schnelle <svens@linux.ibm.com>
Reviewed-by: Vasily Gorbik <gor@linux.ibm.com>
Signed-off-by: Vasily Gorbik <gor@linux.ibm.com>
(cherry picked from commit a52e5cdbe8016d4e3e6322fd93d71afddb9a5af9)
Signed-off-by: Sven Schnelle <svens@linux.ibm.com>
---
arch/s390/boot/ipl_report.c | 8 ++++++++
1 file changed, 8 insertions(+)
diff --git a/arch/s390/boot/ipl_report.c b/arch/s390/boot/ipl_report.c
index 0b4965573656..88bacf4999c4 100644
--- a/arch/s390/boot/ipl_report.c
+++ b/arch/s390/boot/ipl_report.c
@@ -57,11 +57,19 @@ static unsigned long find_bootdata_space(struct ipl_rb_components *comps,
if (IS_ENABLED(CONFIG_BLK_DEV_INITRD) && INITRD_START && INITRD_SIZE &&
intersects(INITRD_START, INITRD_SIZE, safe_addr, size))
safe_addr = INITRD_START + INITRD_SIZE;
+ if (intersects(safe_addr, size, (unsigned long)comps, comps->len)) {
+ safe_addr = (unsigned long)comps + comps->len;
+ goto repeat;
+ }
for_each_rb_entry(comp, comps)
if (intersects(safe_addr, size, comp->addr, comp->len)) {
safe_addr = comp->addr + comp->len;
goto repeat;
}
+ if (intersects(safe_addr, size, (unsigned long)certs, certs->len)) {
+ safe_addr = (unsigned long)certs + certs->len;
+ goto repeat;
+ }
for_each_rb_entry(cert, certs)
if (intersects(safe_addr, size, cert->addr, cert->len)) {
safe_addr = cert->addr + cert->len;
--
2.37.2
^ permalink raw reply related [flat|nested] 3+ messages in thread
* Re: [PATCH 5.10.y] s390/ipl: add missing intersection check to ipl_report handling
2023-03-20 10:32 ` [PATCH 5.10.y] s390/ipl: add missing intersection check to ipl_report handling Sven Schnelle
@ 2023-03-20 13:33 ` Greg KH
0 siblings, 0 replies; 3+ messages in thread
From: Greg KH @ 2023-03-20 13:33 UTC (permalink / raw)
To: Sven Schnelle; +Cc: stable, gor
On Mon, Mar 20, 2023 at 11:32:02AM +0100, Sven Schnelle wrote:
> The code which handles the ipl report is searching for a free location
> in memory where it could copy the component and certificate entries to.
> It checks for intersection between the sections required for the kernel
> and the component/certificate data area, but fails to check whether
> the data structures linking these data areas together intersect.
>
> This might cause the iplreport copy code to overwrite the iplreport
> itself. Fix this by adding two addtional intersection checks.
>
> Cc: <stable@vger.kernel.org>
> Fixes: 9641b8cc733f ("s390/ipl: read IPL report at early boot")
> Signed-off-by: Sven Schnelle <svens@linux.ibm.com>
> Reviewed-by: Vasily Gorbik <gor@linux.ibm.com>
> Signed-off-by: Vasily Gorbik <gor@linux.ibm.com>
> (cherry picked from commit a52e5cdbe8016d4e3e6322fd93d71afddb9a5af9)
> Signed-off-by: Sven Schnelle <svens@linux.ibm.com>
> ---
> arch/s390/boot/ipl_report.c | 8 ++++++++
> 1 file changed, 8 insertions(+)
Both now queued up, thanks.
greg k-h
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2023-03-20 13:34 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2023-03-20 9:18 FAILED: patch "[PATCH] s390/ipl: add missing intersection check to ipl_report" failed to apply to 5.10-stable tree gregkh
2023-03-20 10:32 ` [PATCH 5.10.y] s390/ipl: add missing intersection check to ipl_report handling Sven Schnelle
2023-03-20 13:33 ` Greg KH
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).