iv/linux
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
60fc35f327
linux/drivers/edac
History
Eiichi Tsukata d8655e7630 EDAC: Fix global-out-of-bounds write when setting edac_mc_poll_msec 
Commit 9da21b1509 ("EDAC: Poll timeout cannot be zero, p2") assumes
edac_mc_poll_msec to be unsigned long, but the type of the variable still
remained as int. Setting edac_mc_poll_msec can trigger out-of-bounds
write.

Reproducer:

  # echo 1001 > /sys/module/edac_core/parameters/edac_mc_poll_msec

KASAN report:

  BUG: KASAN: global-out-of-bounds in edac_set_poll_msec+0x140/0x150
  Write of size 8 at addr ffffffffb91b2d00 by task bash/1996

  CPU: 1 PID: 1996 Comm: bash Not tainted 5.2.0-rc6+ #23
  Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-2.fc30 04/01/2014
  Call Trace:
   dump_stack+0xca/0x13e
   print_address_description.cold+0x5/0x246
   __kasan_report.cold+0x75/0x9a
   ? edac_set_poll_msec+0x140/0x150
   kasan_report+0xe/0x20
   edac_set_poll_msec+0x140/0x150
   ? dimmdev_location_show+0x30/0x30
   ? vfs_lock_file+0xe0/0xe0
   ? _raw_spin_lock+0x87/0xe0
   param_attr_store+0x1b5/0x310
   ? param_array_set+0x4f0/0x4f0
   module_attr_store+0x58/0x80
   ? module_attr_show+0x80/0x80
   sysfs_kf_write+0x13d/0x1a0
   kernfs_fop_write+0x2bc/0x460
   ? sysfs_kf_bin_read+0x270/0x270
   ? kernfs_notify+0x1f0/0x1f0
   __vfs_write+0x81/0x100
   vfs_write+0x1e1/0x560
   ksys_write+0x126/0x250
   ? __ia32_sys_read+0xb0/0xb0
   ? do_syscall_64+0x1f/0x390
   do_syscall_64+0xc1/0x390
   entry_SYSCALL_64_after_hwframe+0x49/0xbe
  RIP: 0033:0x7fa7caa5e970
  Code: 73 01 c3 48 8b 0d 28 d5 2b 00 f7 d8 64 89 01 48 83 c8 ff c3 66 0f 1f 44 00 00 83 3d 99 2d 2c 00 00 75 10 b8 01 00 00 00 04
  RSP: 002b:00007fff6acfdfe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
  RAX: ffffffffffffffda RBX: 0000000000000005 RCX: 00007fa7caa5e970
  RDX: 0000000000000005 RSI: 0000000000e95c08 RDI: 0000000000000001
  RBP: 0000000000e95c08 R08: 00007fa7cad1e760 R09: 00007fa7cb36a700
  R10: 0000000000000073 R11: 0000000000000246 R12: 0000000000000005
  R13: 0000000000000001 R14: 00007fa7cad1d600 R15: 0000000000000005

  The buggy address belongs to the variable:
   edac_mc_poll_msec+0x0/0x40

  Memory state around the buggy address:
   ffffffffb91b2c00: 00 00 00 00 fa fa fa fa 00 00 00 00 fa fa fa fa
   ffffffffb91b2c80: 00 00 00 00 fa fa fa fa 00 00 00 00 fa fa fa fa
  >ffffffffb91b2d00: 04 fa fa fa fa fa fa fa 04 fa fa fa fa fa fa fa
                     ^
   ffffffffb91b2d80: 04 fa fa fa fa fa fa fa 00 00 00 00 00 00 00 00
   ffffffffb91b2e00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Fix it by changing the type of edac_mc_poll_msec to unsigned int.
The reason why this patch adopts unsigned int rather than unsigned long
is msecs_to_jiffies() assumes arg to be unsigned int. We can avoid
integer conversion bugs and unsigned int will be large enough for
edac_mc_poll_msec.

Reviewed-by: James Morse <james.morse@arm.com>
Fixes: 9da21b1509 ("EDAC: Poll timeout cannot be zero, p2")
Signed-off-by: Eiichi Tsukata <devel@etsukata.com>
Signed-off-by: Tony Luck <tony.luck@intel.com>
2019-06-27 10:24:47 -07:00
..
altera_edac.c EDAC/altera: Add Stratix10 SDMMC support 2019-06-20 11:44:36 -07:00
altera_edac.h EDAC/altera, firmware/intel: Add Stratix10 ECC DBE SMC call 2019-04-02 17:42:15 +02:00
amd64_edac_dbg.c
amd64_edac_inj.c
amd64_edac.c treewide: Add SPDX license identifier for more missed files 2019-05-21 10:50:45 +02:00
amd64_edac.h Revert "EDAC/amd64: Support more than two controllers for chip select handling" 2019-04-25 16:30:34 +02:00
amd76x_edac.c
amd8111_edac.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 333 2019-06-05 17:37:06 +02:00
amd8111_edac.h treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 333 2019-06-05 17:37:06 +02:00
amd8131_edac.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 333 2019-06-05 17:37:06 +02:00
amd8131_edac.h treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 333 2019-06-05 17:37:06 +02:00
aspeed_edac.c EDAC/aspeed: Remove set but not used variable 'np' 2019-06-20 11:44:36 -07:00
cell_edac.c
cpc925_edac.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 333 2019-06-05 17:37:06 +02:00
debugfs.c EDAC: Make edac_debugfs_create_x*() return void 2019-06-20 11:44:36 -07:00
e7xxx_edac.c
e752x_edac.c EDAC: Fix indentation issues in several EDAC drivers 2018-11-10 16:56:16 +01:00
edac_device_sysfs.c
edac_device.c
edac_device.h
edac_mc_sysfs.c EDAC: Fix global-out-of-bounds write when setting edac_mc_poll_msec 2019-06-27 10:24:47 -07:00
edac_mc.c EDAC/mc: Fix edac_mc_find() in case no device is found 2019-05-14 17:08:46 +02:00
edac_mc.h
edac_module.c
edac_module.h EDAC: Fix global-out-of-bounds write when setting edac_mc_poll_msec 2019-06-27 10:24:47 -07:00
edac_pci_sysfs.c
edac_pci.c
edac_pci.h
fsl_ddr_edac.c EDAC, fsl_ddr: Add LS1021A to the list of supported hardware 2018-12-19 11:57:45 +01:00
fsl_ddr_edac.h EDAC, fsl_ddr: Add LS1021A to the list of supported hardware 2018-12-19 11:57:45 +01:00
ghes_edac.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 172 2019-05-30 11:26:39 -07:00
highbank_l2_edac.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 201 2019-05-30 11:29:52 -07:00
highbank_mc_edac.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 201 2019-05-30 11:29:52 -07:00
i7core_edac.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 172 2019-05-30 11:26:39 -07:00
i10nm_base.c EDAC, skx, i10nm: Fix source ID register offset 2019-06-26 10:07:27 -07:00
i3000_edac.c EDAC: Fix indentation issues in several EDAC drivers 2018-11-10 16:56:16 +01:00
i3200_edac.c EDAC: Correct DIMM capacity unit symbol 2018-09-22 18:18:57 +02:00
i5000_edac.c EDAC, i5000: Remove set but not used local variables 2018-12-11 14:53:49 +01:00
i5100_edac.c
i5400_edac.c
i7300_edac.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 172 2019-05-30 11:26:39 -07:00
i82443bxgx_edac.c
i82860_edac.c
i82875p_edac.c
i82975x_edac.c EDAC, i82975x: Fix spelling mistake "reserverd" -> "reserved" 2018-11-20 17:46:01 +01:00
ie31200_edac.c EDAC/ie31200: Reformat PCI device table 2019-06-20 11:44:36 -07:00
Kconfig EDAC/sifive: Add EDAC platform driver for SiFive SoCs 2019-06-20 11:44:36 -07:00
layerscape_edac.c
Makefile EDAC/sifive: Add EDAC platform driver for SiFive SoCs 2019-06-20 11:44:36 -07:00
mce_amd.c treewide: Add SPDX license identifier for more missed files 2019-05-21 10:50:45 +02:00
mce_amd.h
mpc85xx_edac.c
mpc85xx_edac.h
mv64x60_edac.c EDAC, mv64x60: Fix an error handling path 2018-01-09 20:14:23 +01:00
mv64x60_edac.h
octeon_edac-l2c.c
octeon_edac-lmc.c
octeon_edac-pc.c
octeon_edac-pci.c
pasemi_edac.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 333 2019-06-05 17:37:06 +02:00
pnd2_edac.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 288 2019-06-05 17:36:37 +02:00
pnd2_edac.h treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 288 2019-06-05 17:36:37 +02:00
ppc4xx_edac.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 441 2019-06-05 17:37:17 +02:00
ppc4xx_edac.h treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 441 2019-06-05 17:37:17 +02:00
qcom_edac.c EDAC, qcom_edac: Remove irq_handled local variable 2018-11-06 12:03:16 +01:00
r82600_edac.c
sb_edac.c EDAC/sb_edac: Remove redundant update of tad_base 2019-06-20 11:44:36 -07:00
sifive_edac.c EDAC/sifive: Add EDAC platform driver for SiFive SoCs 2019-06-20 11:44:36 -07:00
skx_base.c EDAC, skx, i10nm: Fix source ID register offset 2019-06-26 10:07:27 -07:00
skx_common.c EDAC, skx, i10nm: Fix source ID register offset 2019-06-26 10:07:27 -07:00
skx_common.h EDAC, skx, i10nm: Fix source ID register offset 2019-06-26 10:07:27 -07:00
synopsys_edac.c EDAC, synopsys: Add Error Injection support for ZynqMP DDR controller 2018-11-06 10:38:27 +01:00
thunderx_edac.c EDAC, thunderx: Fix memory leak in thunderx_l2c_threaded_isr() 2018-10-13 13:58:06 +02:00
ti_edac.c
wq.c treewide: Add SPDX license identifier for missed files 2019-05-21 10:50:45 +02:00
x38_edac.c
xgene_edac.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 13 2019-05-21 11:28:45 +02:00