From: Ben Hutchings <ben@decadent.org.uk>
To: linux-kernel@vger.kernel.org, stable@vger.kernel.org
Cc: akpm@linux-foundation.org, Denis Kirjanov <kda@linux-powerpc.org>,
"Eiichi Tsukata" <devel@etsukata.com>,
"James Morse" <james.morse@arm.com>,
"Tony Luck" <tony.luck@intel.com>
Subject: [PATCH 3.16 25/47] EDAC: Fix global-out-of-bounds write when setting edac_mc_poll_msec
Date: Fri, 25 Oct 2019 19:03:26 +0100 [thread overview]
Message-ID: <lsq.1572026582.529341772@decadent.org.uk> (raw)
In-Reply-To: <lsq.1572026581.992411028@decadent.org.uk>
3.16.76-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Eiichi Tsukata <devel@etsukata.com>
commit d8655e7630dafa88bc37f101640e39c736399771 upstream.
Commit 9da21b1509d8 ("EDAC: Poll timeout cannot be zero, p2") assumes
edac_mc_poll_msec to be unsigned long, but the type of the variable still
remained as int. Setting edac_mc_poll_msec can trigger out-of-bounds
write.
Reproducer:
# echo 1001 > /sys/module/edac_core/parameters/edac_mc_poll_msec
KASAN report:
BUG: KASAN: global-out-of-bounds in edac_set_poll_msec+0x140/0x150
Write of size 8 at addr ffffffffb91b2d00 by task bash/1996
CPU: 1 PID: 1996 Comm: bash Not tainted 5.2.0-rc6+ #23
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-2.fc30 04/01/2014
Call Trace:
dump_stack+0xca/0x13e
print_address_description.cold+0x5/0x246
__kasan_report.cold+0x75/0x9a
? edac_set_poll_msec+0x140/0x150
kasan_report+0xe/0x20
edac_set_poll_msec+0x140/0x150
? dimmdev_location_show+0x30/0x30
? vfs_lock_file+0xe0/0xe0
? _raw_spin_lock+0x87/0xe0
param_attr_store+0x1b5/0x310
? param_array_set+0x4f0/0x4f0
module_attr_store+0x58/0x80
? module_attr_show+0x80/0x80
sysfs_kf_write+0x13d/0x1a0
kernfs_fop_write+0x2bc/0x460
? sysfs_kf_bin_read+0x270/0x270
? kernfs_notify+0x1f0/0x1f0
__vfs_write+0x81/0x100
vfs_write+0x1e1/0x560
ksys_write+0x126/0x250
? __ia32_sys_read+0xb0/0xb0
? do_syscall_64+0x1f/0x390
do_syscall_64+0xc1/0x390
entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x7fa7caa5e970
Code: 73 01 c3 48 8b 0d 28 d5 2b 00 f7 d8 64 89 01 48 83 c8 ff c3 66 0f 1f 44 00 00 83 3d 99 2d 2c 00 00 75 10 b8 01 00 00 00 04
RSP: 002b:00007fff6acfdfe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
RAX: ffffffffffffffda RBX: 0000000000000005 RCX: 00007fa7caa5e970
RDX: 0000000000000005 RSI: 0000000000e95c08 RDI: 0000000000000001
RBP: 0000000000e95c08 R08: 00007fa7cad1e760 R09: 00007fa7cb36a700
R10: 0000000000000073 R11: 0000000000000246 R12: 0000000000000005
R13: 0000000000000001 R14: 00007fa7cad1d600 R15: 0000000000000005
The buggy address belongs to the variable:
edac_mc_poll_msec+0x0/0x40
Memory state around the buggy address:
ffffffffb91b2c00: 00 00 00 00 fa fa fa fa 00 00 00 00 fa fa fa fa
ffffffffb91b2c80: 00 00 00 00 fa fa fa fa 00 00 00 00 fa fa fa fa
>ffffffffb91b2d00: 04 fa fa fa fa fa fa fa 04 fa fa fa fa fa fa fa
^
ffffffffb91b2d80: 04 fa fa fa fa fa fa fa 00 00 00 00 00 00 00 00
ffffffffb91b2e00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Fix it by changing the type of edac_mc_poll_msec to unsigned int.
The reason why this patch adopts unsigned int rather than unsigned long
is msecs_to_jiffies() assumes arg to be unsigned int. We can avoid
integer conversion bugs and unsigned int will be large enough for
edac_mc_poll_msec.
Reviewed-by: James Morse <james.morse@arm.com>
Fixes: 9da21b1509d8 ("EDAC: Poll timeout cannot be zero, p2")
Signed-off-by: Eiichi Tsukata <devel@etsukata.com>
Signed-off-by: Tony Luck <tony.luck@intel.com>
[bwh: Backported to 3.16: adjust context]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
drivers/edac/edac_mc_sysfs.c | 16 ++++++++--------
drivers/edac/edac_module.h | 2 +-
2 files changed, 9 insertions(+), 9 deletions(-)
--- a/drivers/edac/edac_mc_sysfs.c
+++ b/drivers/edac/edac_mc_sysfs.c
@@ -26,7 +26,7 @@
static int edac_mc_log_ue = 1;
static int edac_mc_log_ce = 1;
static int edac_mc_panic_on_ue;
-static int edac_mc_poll_msec = 1000;
+static unsigned int edac_mc_poll_msec = 1000;
/* Getter functions for above */
int edac_mc_get_log_ue(void)
@@ -45,30 +45,30 @@ int edac_mc_get_panic_on_ue(void)
}
/* this is temporary */
-int edac_mc_get_poll_msec(void)
+unsigned int edac_mc_get_poll_msec(void)
{
return edac_mc_poll_msec;
}
static int edac_set_poll_msec(const char *val, struct kernel_param *kp)
{
- unsigned long l;
+ unsigned int i;
int ret;
if (!val)
return -EINVAL;
- ret = kstrtoul(val, 0, &l);
+ ret = kstrtouint(val, 0, &i);
if (ret)
return ret;
- if (l < 1000)
+ if (i < 1000)
return -EINVAL;
- *((unsigned long *)kp->arg) = l;
+ *((unsigned int *)kp->arg) = i;
/* notify edac_mc engine to reset the poll period */
- edac_mc_reset_delay_period(l);
+ edac_mc_reset_delay_period(i);
return 0;
}
@@ -82,7 +82,7 @@ MODULE_PARM_DESC(edac_mc_log_ue,
module_param(edac_mc_log_ce, int, 0644);
MODULE_PARM_DESC(edac_mc_log_ce,
"Log correctable error to console: 0=off 1=on");
-module_param_call(edac_mc_poll_msec, edac_set_poll_msec, param_get_int,
+module_param_call(edac_mc_poll_msec, edac_set_poll_msec, param_get_uint,
&edac_mc_poll_msec, 0644);
MODULE_PARM_DESC(edac_mc_poll_msec, "Polling period in milliseconds");
--- a/drivers/edac/edac_module.h
+++ b/drivers/edac/edac_module.h
@@ -32,7 +32,7 @@ extern int edac_mc_get_log_ue(void);
extern int edac_mc_get_log_ce(void);
extern int edac_mc_get_panic_on_ue(void);
extern int edac_get_poll_msec(void);
-extern int edac_mc_get_poll_msec(void);
+extern unsigned int edac_mc_get_poll_msec(void);
unsigned edac_dimm_info_location(struct dimm_info *dimm, char *buf,
unsigned len);
next prev parent reply other threads:[~2019-10-25 18:06 UTC|newest]
Thread overview: 57+ messages / expand[flat|nested] mbox.gz Atom feed top
2019-10-25 18:03 [PATCH 3.16 00/47] 3.16.76-rc1 review Ben Hutchings
2019-10-25 18:03 ` [PATCH 3.16 01/47] eCryptfs: fix a couple type promotion bugs Ben Hutchings
2019-10-25 18:03 ` [PATCH 3.16 02/47] ARM: riscpc: fix DMA Ben Hutchings
2019-10-25 18:03 ` [PATCH 3.16 03/47] 9p/virtio: Add cleanup path in p9_virtio_init Ben Hutchings
2019-10-25 18:03 ` [PATCH 3.16 04/47] tty: serial: cpm_uart - fix init when SMC is relocated Ben Hutchings
2019-10-25 18:03 ` [PATCH 3.16 05/47] signal/pid_namespace: Fix reboot_pid_ns to use send_sig not force_sig Ben Hutchings
2019-10-25 18:03 ` [PATCH 3.16 06/47] xfrm: Fix xfrm sel prefix length validation Ben Hutchings
2019-10-25 18:03 ` [PATCH 3.16 07/47] af_key: fix leaks in key_pol_get_resp and dump_sp Ben Hutchings
2019-10-25 18:03 ` [PATCH 3.16 08/47] crypto: talitos - check AES key size Ben Hutchings
2019-10-25 18:03 ` [PATCH 3.16 09/47] crypto: ghash - fix unaligned memory access in ghash_setkey() Ben Hutchings
2019-10-25 18:03 ` [PATCH 3.16 10/47] s390/qdio: handle PENDING state for QEBSM devices Ben Hutchings
2019-10-25 18:03 ` [PATCH 3.16 11/47] memstick: Fix error cleanup path of memstick_init Ben Hutchings
2019-10-25 18:03 ` [PATCH 3.16 12/47] gpio: omap: fix lack of irqstatus_raw0 for OMAP4 Ben Hutchings
2019-10-25 18:03 ` [PATCH 3.16 13/47] xfrm: fix sa selector validation Ben Hutchings
2019-10-25 18:03 ` [PATCH 3.16 14/47] PCI: Do not poll for PME if the device is in D3cold Ben Hutchings
2019-10-25 18:03 ` [PATCH 3.16 15/47] usb: gadget: ether: Fix race between gether_disconnect and rx_submit Ben Hutchings
2019-10-25 18:03 ` [PATCH 3.16 16/47] powerpc/32s: fix suspend/resume when IBATs 4-7 are used Ben Hutchings
2019-10-25 18:03 ` [PATCH 3.16 17/47] powerpc/watchpoint: Restore NV GPRs while returning from exception Ben Hutchings
2019-10-25 18:03 ` [PATCH 3.16 18/47] USB: serial: option: add GosunCn ZTE WeLink ME3630 Ben Hutchings
2019-10-25 18:03 ` [PATCH 3.16 19/47] USB: serial: option: add support for GosunCn ME3630 RNDIS mode Ben Hutchings
2019-10-25 18:03 ` [PATCH 3.16 20/47] s390: fix stfle zero padding Ben Hutchings
2019-10-25 18:03 ` [PATCH 3.16 21/47] VMCI: Fix integer overflow in VMCI handle arrays Ben Hutchings
2019-10-25 18:03 ` [PATCH 3.16 22/47] mwifiex: Don't abort on small, spec-compliant vendor IEs Ben Hutchings
2019-10-25 18:03 ` [PATCH 3.16 23/47] mwifiex: fix 802.11n/WPA detection Ben Hutchings
2019-10-25 18:03 ` [PATCH 3.16 24/47] media: v4l2: Test type instead of cfg->type in v4l2_ctrl_new_custom() Ben Hutchings
2019-10-25 18:03 ` Ben Hutchings [this message]
2019-10-25 18:03 ` [PATCH 3.16 26/47] carl9170: fix misuse of device driver API Ben Hutchings
2019-10-25 18:03 ` [PATCH 3.16 27/47] x86/ptrace: Fix possible spectre-v1 in ptrace_get_debugreg() Ben Hutchings
2019-10-25 18:03 ` [PATCH 3.16 28/47] x86/tls: Fix possible spectre-v1 in do_get_thread_area() Ben Hutchings
2019-10-25 18:03 ` [PATCH 3.16 29/47] USB: serial: ftdi_sio: add ID for isodebug v1 Ben Hutchings
2019-10-25 18:03 ` [PATCH 3.16 30/47] igmp: fix memory leak in igmpv3_del_delrec() Ben Hutchings
2019-10-25 18:03 ` [PATCH 3.16 31/47] s390/qdio: (re-)initialize tiqdio list entries Ben Hutchings
2019-10-25 18:03 ` [PATCH 3.16 32/47] s390/qdio: don't touch the dsci in tiqdio_add_input_queues() Ben Hutchings
2019-10-25 18:03 ` [PATCH 3.16 33/47] net: bridge: stp: don't cache eth dest pointer before skb pull Ben Hutchings
2019-10-25 18:03 ` [PATCH 3.16 34/47] lib/scatterlist: Fix mapping iterator when sg->offset is greater than PAGE_SIZE Ben Hutchings
2019-10-25 18:03 ` [PATCH 3.16 35/47] bonding: validate ip header before check IPPROTO_IGMP Ben Hutchings
2019-10-25 18:03 ` [PATCH 3.16 36/47] NFSv4: Handle the special Linux file open access mode Ben Hutchings
2019-10-25 18:03 ` [PATCH 3.16 37/47] ARC: hide unused function unw_hdr_alloc Ben Hutchings
2019-10-25 18:03 ` [PATCH 3.16 38/47] udf: Fix incorrect final NOT_ALLOCATED (hole) extent length Ben Hutchings
2019-10-25 18:03 ` [PATCH 3.16 39/47] mm/mmu_notifier: use hlist_add_head_rcu() Ben Hutchings
2019-10-25 18:03 ` [PATCH 3.16 40/47] net: neigh: fix multiple neigh timer scheduling Ben Hutchings
2019-10-25 18:03 ` [PATCH 3.16 41/47] ALSA: seq: Break too long mutex context in the write loop Ben Hutchings
2019-10-25 18:03 ` [PATCH 3.16 42/47] coda: pass the host file in vma->vm_file on mmap Ben Hutchings
2019-10-25 18:03 ` [PATCH 3.16 43/47] caif-hsi: fix possible deadlock in cfhsi_exit_module() Ben Hutchings
2019-10-25 18:03 ` [PATCH 3.16 44/47] parisc: Fix kernel panic due invalid values in IAOQ0 or IAOQ1 Ben Hutchings
2019-10-25 18:03 ` [PATCH 3.16 45/47] padata: use smp_mb in padata_reorder to avoid orphaned padata jobs Ben Hutchings
2019-10-25 18:03 ` [PATCH 3.16 46/47] Input: psmouse - fix build error of multiple definition Ben Hutchings
2019-10-25 18:03 ` [PATCH 3.16 47/47] KVM: x86/vPMU: refine kvm_pmu err msg when event creation failed Ben Hutchings
2019-10-25 19:05 ` Joe Perches
2019-10-31 22:14 ` Ben Hutchings
2019-10-31 22:53 ` Joe Perches
2019-10-31 22:56 ` Paolo Bonzini
2019-11-01 8:07 ` Sasha Levin
2019-11-01 15:40 ` Joe Perches
2019-11-02 7:39 ` Sasha Levin
2019-10-26 1:35 ` [PATCH 3.16 00/47] 3.16.76-rc1 review Guenter Roeck
2019-10-26 18:00 ` Ben Hutchings
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=lsq.1572026582.529341772@decadent.org.uk \
--to=ben@decadent.org.uk \
--cc=akpm@linux-foundation.org \
--cc=devel@etsukata.com \
--cc=james.morse@arm.com \
--cc=kda@linux-powerpc.org \
--cc=linux-kernel@vger.kernel.org \
--cc=stable@vger.kernel.org \
--cc=tony.luck@intel.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox