Message ID | 1445871783-18365-1-git-send-email-toshi.kani@hpe.com (mailing list archive) |
---|---|
State | Not Applicable, archived |
Headers | show |
- pfn = PFN_DOWN(param1 & param2); - if (!page_is_ram(pfn) || ((param2 & PAGE_MASK) != PAGE_MASK)) + base_addr = param1 & param2; + size = (~param2) + 1; We expect the user will supply us with param2 in the form 0xffffffff[fec8]00000 with various numbers of leading 'f' and trailing '0' ... but I don't think we actually check that anywhere. But we have a bunch of places that assume it is OK, including this new one. It's time to fix that. Maybe even provide a default 0xfffffffffffff000 so I can save myself some typing? -Tony -- To unsubscribe from this list: send the line "unsubscribe linux-acpi" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html
On Mon, 2015-10-26 at 16:26 +0000, Luck, Tony wrote: > - pfn = PFN_DOWN(param1 & param2); > - if (!page_is_ram(pfn) || ((param2 & PAGE_MASK) != PAGE_MASK)) > + base_addr = param1 & param2; > + size = (~param2) + 1; > > We expect the user will supply us with param2 in the form 0xffffffff[fec8]00000 > with various numbers of leading 'f' and trailing '0' ... but I don't think we actually > check that anywhere. But we have a bunch of places that assume it is OK, including > this new one. > > It's time to fix that. Maybe even provide a default 0xfffffffffffff000 so I can save > myself some typing? + if (((region_intersects_ram(base_addr, size) != REGION_INTERSECTS) && + (region_intersects_pmem(base_addr, size) != REGION_INTERSECTS)) || + ((param2 & PAGE_MASK) != PAGE_MASK)) return -EINVAL; The 3rd condition check makes sure that the param2 mask is the page size or less. So, I think we are OK on this. Thanks, -Toshi -- To unsubscribe from this list: send the line "unsubscribe linux-acpi" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html
> + ((param2 & PAGE_MASK) != PAGE_MASK)) > return -EINVAL; > > The 3rd condition check makes sure that the param2 mask is the page size or less. So, I > think we are OK on this. Oops. The original was even on the screen as part of the diff (which I signed off on just two years ago). I'd be happier if you made it the 1st condition though, so we skip calling region_intersects_*() with a nonsense "size" argument. -Tony
On Mon, 2015-10-26 at 16:46 +0000, Luck, Tony wrote: > > + ((param2 & PAGE_MASK) != PAGE_MASK)) > > return -EINVAL; > > > > The 3rd condition check makes sure that the param2 mask is the page size or less. So, > > I think we are OK on this. > > Oops. The original was even on the screen as part of the diff (which I signed off on > just two years ago). > > I'd be happier if you made it the 1st condition though, so we skip calling > region_intersects_*() with a nonsense "size" argument. Agreed. I will send an updated patch 3/3 later today, "[PATCH v2 UPDATE-2 3/3]". Thanks, -Toshi -- To unsubscribe from this list: send the line "unsubscribe linux-acpi" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html
diff --git a/drivers/acpi/apei/einj.c b/drivers/acpi/apei/einj.c index 0431883..db21efe 100644 --- a/drivers/acpi/apei/einj.c +++ b/drivers/acpi/apei/einj.c @@ -519,7 +519,7 @@ static int einj_error_inject(u32 type, u32 flags, u64 param1, u64 param2, u64 param3, u64 param4) { int rc; - unsigned long pfn; + u64 base_addr, size; /* If user manually set "flags", make sure it is legal */ if (flags && (flags & @@ -545,10 +545,15 @@ static int einj_error_inject(u32 type, u32 flags, u64 param1, u64 param2, /* * Disallow crazy address masks that give BIOS leeway to pick * injection address almost anywhere. Insist on page or - * better granularity and that target address is normal RAM. + * better granularity and that target address is normal RAM or + * NVDIMM. */ - pfn = PFN_DOWN(param1 & param2); - if (!page_is_ram(pfn) || ((param2 & PAGE_MASK) != PAGE_MASK)) + base_addr = param1 & param2; + size = (~param2) + 1; + + if (((region_intersects_ram(base_addr, size) != REGION_INTERSECTS) && + (region_intersects_pmem(base_addr, size) != REGION_INTERSECTS)) || + ((param2 & PAGE_MASK) != PAGE_MASK)) return -EINVAL; inject: