From patchwork Tue Feb 27 17:29:51 2018 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ross Zwisler X-Patchwork-Id: 10245833 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork.web.codeaurora.org (Postfix) with ESMTP id C4D9E60362 for ; Tue, 27 Feb 2018 17:30:07 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id B3A0628A0D for ; Tue, 27 Feb 2018 17:30:07 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id A8BF128A13; Tue, 27 Feb 2018 17:30:07 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-1.9 required=2.0 tests=BAYES_00, RCVD_IN_DNSWL_NONE autolearn=ham version=3.3.1 Received: from ml01.01.org (ml01.01.org [198.145.21.10]) (using TLSv1.2 with cipher DHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.wl.linuxfoundation.org (Postfix) with ESMTPS id 3794C28A0D for ; Tue, 27 Feb 2018 17:30:07 +0000 (UTC) Received: from [127.0.0.1] (localhost [IPv6:::1]) by ml01.01.org (Postfix) with ESMTP id D18F6209574D1; Tue, 27 Feb 2018 09:23:59 -0800 (PST) X-Original-To: linux-nvdimm@lists.01.org Delivered-To: linux-nvdimm@lists.01.org Received-SPF: None (no SPF record) identity=mailfrom; client-ip=192.55.52.43; helo=mga05.intel.com; envelope-from=ross.zwisler@linux.intel.com; receiver=linux-nvdimm@lists.01.org Received: from mga05.intel.com (mga05.intel.com [192.55.52.43]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ml01.01.org (Postfix) with ESMTPS id 82701223522AA for ; Tue, 27 Feb 2018 09:23:58 -0800 (PST) X-Amp-Result: SKIPPED(no attachment in message) X-Amp-File-Uploaded: False Received: from fmsmga002.fm.intel.com ([10.253.24.26]) by fmsmga105.fm.intel.com with ESMTP/TLS/DHE-RSA-AES256-GCM-SHA384; 27 Feb 2018 09:30:03 -0800 X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="5.47,401,1515484800"; d="scan'208";a="23638773" Received: from theros.lm.intel.com ([10.232.112.164]) by fmsmga002.fm.intel.com with ESMTP; 27 Feb 2018 09:30:03 -0800 From: Ross Zwisler To: Dan Williams , linux-nvdimm@lists.01.org, Dave Jiang , Vishal L Verma , linux-kernel@vger.kernel.org Subject: [PATCH 2/3] nfit_test: fix buffer overrun, add sanity check Date: Tue, 27 Feb 2018 10:29:51 -0700 Message-Id: <20180227172952.22177-2-ross.zwisler@linux.intel.com> X-Mailer: git-send-email 2.14.3 In-Reply-To: <20180227172952.22177-1-ross.zwisler@linux.intel.com> References: <20180227172952.22177-1-ross.zwisler@linux.intel.com> X-BeenThere: linux-nvdimm@lists.01.org X-Mailman-Version: 2.1.23 Precedence: list List-Id: "Linux-nvdimm developer list." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , MIME-Version: 1.0 Errors-To: linux-nvdimm-bounces@lists.01.org Sender: "Linux-nvdimm" X-Virus-Scanned: ClamAV using ClamSMTP It turns out that we were overrunning the 'nfit_buf' buffer in nfit_test0_setup() in the (t->setup_hotplug == 1) case because we failed to correctly account for all of the acpi_nfit_memory_map structures. Fix the structure count which will increase the allocation size of 'nfit_buf' in nfit_test0_alloc(). Also add some WARN_ON()s to nfit_test0_setup() and nfit_test1_setup() to catch future issues where the size of the buffer doesn't match the amount of data we're writing. Signed-off-by: Ross Zwisler --- tools/testing/nvdimm/test/nfit.c | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/tools/testing/nvdimm/test/nfit.c b/tools/testing/nvdimm/test/nfit.c index 1376fc95c33a..fcd233342273 100644 --- a/tools/testing/nvdimm/test/nfit.c +++ b/tools/testing/nvdimm/test/nfit.c @@ -104,7 +104,8 @@ enum { NUM_HINTS = 8, NUM_BDW = NUM_DCR, NUM_SPA = NUM_PM + NUM_DCR + NUM_BDW, - NUM_MEM = NUM_DCR + NUM_BDW + 2 /* spa0 iset */ + 4 /* spa1 iset */, + NUM_MEM = NUM_DCR + NUM_BDW + 2 /* spa0 iset */ + + 4 /* spa1 iset */ + 1 /* spa11 iset */, DIMM_SIZE = SZ_32M, LABEL_SIZE = SZ_128K, SPA_VCD_SIZE = SZ_4M, @@ -2047,6 +2048,9 @@ static void nfit_test0_setup(struct nfit_test *t) flush->hint_address[i] = t->flush_dma[4] + i * sizeof(u64); offset += flush->header.length; + + /* sanity check to make sure we've filled the buffer */ + WARN_ON(offset != t->nfit_size); } post_ars_status(&t->ars_state, &t->badrange, t->spa_set_dma[0], @@ -2165,6 +2169,9 @@ static void nfit_test1_setup(struct nfit_test *t) dcr->windows = 0; offset += dcr->header.length; + /* sanity check to make sure we've filled the buffer */ + WARN_ON(offset != t->nfit_size); + post_ars_status(&t->ars_state, &t->badrange, t->spa_set_dma[0], SPA2_SIZE);