| Message ID | 20180810192315.3471-1-vishal.l.verma@intel.com (mailing list archive) |
|---|---|
| State | New, archived |
| Headers | show |
| Series | libnvdimm: fix ars_status output length calculation | expand |
Thanks Vishal, looks good!
Reviewed-by: Keith Busch <keith.busch@intel.com>
On 08/10/2018 12:23 PM, Vishal Verma wrote: > Commit efda1b5d87cb ("acpi, nfit, libnvdimm: fix / harden ars_status output length handling") > Introduced additional hardening for ambiguity in the ACPI spec for > ars_status output sizing. However, it had a couple of cases mixed up. > Where it should have been checking for (and returning) "out_field[1] - > 4" it was using "out_field[1] - 8" and vice versa. > > This caused a four byte discrepancy in the buffer size passed on to > the command handler, and in some cases, this caused memory corruption > like: > > ./daxdev-errors.sh: line 76: 24104 Aborted (core dumped) ./daxdev-errors $busdev $region > malloc(): memory corruption > Program received signal SIGABRT, Aborted. > [...] > #5 0x00007ffff7865a2e in calloc () from /lib64/libc.so.6 > #6 0x00007ffff7bc2970 in ndctl_bus_cmd_new_ars_status (ars_cap=ars_cap@entry=0x6153b0) at ars.c:136 > #7 0x0000000000401644 in check_ars_status (check=0x7fffffffdeb0, bus=0x604c20) at daxdev-errors.c:144 > #8 test_daxdev_clear_error (region_name=<optimized out>, bus_name=<optimized out>) > at daxdev-errors.c:332 > > Cc: <stable@vger.kernel.org> > Cc: Dave Jiang <dave.jiang@intel.com> > Cc: Keith Busch <keith.busch@intel.com> > Cc: Lukasz Dorau <lukasz.dorau@intel.com> > Cc: Dan Williams <dan.j.williams@intel.com> > Fixes: efda1b5d87cb ("acpi, nfit, libnvdimm: fix / harden ars_status output length handling") > Signed-off-by: Vishal Verma <vishal.l.verma@intel.com> Applied. > --- > drivers/nvdimm/bus.c | 4 ++-- > 1 file changed, 2 insertions(+), 2 deletions(-) > > diff --git a/drivers/nvdimm/bus.c b/drivers/nvdimm/bus.c > index 27902a8799b1..8aae6dcc839f 100644 > --- a/drivers/nvdimm/bus.c > +++ b/drivers/nvdimm/bus.c > @@ -812,9 +812,9 @@ u32 nd_cmd_out_size(struct nvdimm *nvdimm, int cmd, > * overshoots the remainder by 4 bytes, assume it was > * including 'status'. > */ > - if (out_field[1] - 8 == remainder) > + if (out_field[1] - 4 == remainder) > return remainder; > - return out_field[1] - 4; > + return out_field[1] - 8; > } else if (cmd == ND_CMD_CALL) { > struct nd_cmd_pkg *pkg = (struct nd_cmd_pkg *) in_field; > >
diff --git a/drivers/nvdimm/bus.c b/drivers/nvdimm/bus.c index 27902a8799b1..8aae6dcc839f 100644 --- a/drivers/nvdimm/bus.c +++ b/drivers/nvdimm/bus.c @@ -812,9 +812,9 @@ u32 nd_cmd_out_size(struct nvdimm *nvdimm, int cmd, * overshoots the remainder by 4 bytes, assume it was * including 'status'. */ - if (out_field[1] - 8 == remainder) + if (out_field[1] - 4 == remainder) return remainder; - return out_field[1] - 4; + return out_field[1] - 8; } else if (cmd == ND_CMD_CALL) { struct nd_cmd_pkg *pkg = (struct nd_cmd_pkg *) in_field;
Commit efda1b5d87cb ("acpi, nfit, libnvdimm: fix / harden ars_status output length handling") Introduced additional hardening for ambiguity in the ACPI spec for ars_status output sizing. However, it had a couple of cases mixed up. Where it should have been checking for (and returning) "out_field[1] - 4" it was using "out_field[1] - 8" and vice versa. This caused a four byte discrepancy in the buffer size passed on to the command handler, and in some cases, this caused memory corruption like: ./daxdev-errors.sh: line 76: 24104 Aborted (core dumped) ./daxdev-errors $busdev $region malloc(): memory corruption Program received signal SIGABRT, Aborted. [...] #5 0x00007ffff7865a2e in calloc () from /lib64/libc.so.6 #6 0x00007ffff7bc2970 in ndctl_bus_cmd_new_ars_status (ars_cap=ars_cap@entry=0x6153b0) at ars.c:136 #7 0x0000000000401644 in check_ars_status (check=0x7fffffffdeb0, bus=0x604c20) at daxdev-errors.c:144 #8 test_daxdev_clear_error (region_name=<optimized out>, bus_name=<optimized out>) at daxdev-errors.c:332 Cc: <stable@vger.kernel.org> Cc: Dave Jiang <dave.jiang@intel.com> Cc: Keith Busch <keith.busch@intel.com> Cc: Lukasz Dorau <lukasz.dorau@intel.com> Cc: Dan Williams <dan.j.williams@intel.com> Fixes: efda1b5d87cb ("acpi, nfit, libnvdimm: fix / harden ars_status output length handling") Signed-off-by: Vishal Verma <vishal.l.verma@intel.com> --- drivers/nvdimm/bus.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)