mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2024-08-27 19:29:37 +00:00
d8655e7630
Commit9da21b1509("EDAC: Poll timeout cannot be zero, p2") assumes edac_mc_poll_msec to be unsigned long, but the type of the variable still remained as int. Setting edac_mc_poll_msec can trigger out-of-bounds write. Reproducer: # echo 1001 > /sys/module/edac_core/parameters/edac_mc_poll_msec KASAN report: BUG: KASAN: global-out-of-bounds in edac_set_poll_msec+0x140/0x150 Write of size 8 at addr ffffffffb91b2d00 by task bash/1996 CPU: 1 PID: 1996 Comm: bash Not tainted 5.2.0-rc6+ #23 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-2.fc30 04/01/2014 Call Trace: dump_stack+0xca/0x13e print_address_description.cold+0x5/0x246 __kasan_report.cold+0x75/0x9a ? edac_set_poll_msec+0x140/0x150 kasan_report+0xe/0x20 edac_set_poll_msec+0x140/0x150 ? dimmdev_location_show+0x30/0x30 ? vfs_lock_file+0xe0/0xe0 ? _raw_spin_lock+0x87/0xe0 param_attr_store+0x1b5/0x310 ? param_array_set+0x4f0/0x4f0 module_attr_store+0x58/0x80 ? module_attr_show+0x80/0x80 sysfs_kf_write+0x13d/0x1a0 kernfs_fop_write+0x2bc/0x460 ? sysfs_kf_bin_read+0x270/0x270 ? kernfs_notify+0x1f0/0x1f0 __vfs_write+0x81/0x100 vfs_write+0x1e1/0x560 ksys_write+0x126/0x250 ? __ia32_sys_read+0xb0/0xb0 ? do_syscall_64+0x1f/0x390 do_syscall_64+0xc1/0x390 entry_SYSCALL_64_after_hwframe+0x49/0xbe RIP: 0033:0x7fa7caa5e970 Code: 73 01 c3 48 8b 0d 28 d5 2b 00 f7 d8 64 89 01 48 83 c8 ff c3 66 0f 1f 44 00 00 83 3d 99 2d 2c 00 00 75 10 b8 01 00 00 00 04 RSP: 002b:00007fff6acfdfe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 RAX: ffffffffffffffda RBX: 0000000000000005 RCX: 00007fa7caa5e970 RDX: 0000000000000005 RSI: 0000000000e95c08 RDI: 0000000000000001 RBP: 0000000000e95c08 R08: 00007fa7cad1e760 R09: 00007fa7cb36a700 R10: 0000000000000073 R11: 0000000000000246 R12: 0000000000000005 R13: 0000000000000001 R14: 00007fa7cad1d600 R15: 0000000000000005 The buggy address belongs to the variable: edac_mc_poll_msec+0x0/0x40 Memory state around the buggy address: ffffffffb91b2c00: 00 00 00 00 fa fa fa fa 00 00 00 00 fa fa fa fa ffffffffb91b2c80: 00 00 00 00 fa fa fa fa 00 00 00 00 fa fa fa fa >ffffffffb91b2d00: 04 fa fa fa fa fa fa fa 04 fa fa fa fa fa fa fa ^ ffffffffb91b2d80: 04 fa fa fa fa fa fa fa 00 00 00 00 00 00 00 00 ffffffffb91b2e00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Fix it by changing the type of edac_mc_poll_msec to unsigned int. The reason why this patch adopts unsigned int rather than unsigned long is msecs_to_jiffies() assumes arg to be unsigned int. We can avoid integer conversion bugs and unsigned int will be large enough for edac_mc_poll_msec. Reviewed-by: James Morse <james.morse@arm.com> Fixes:9da21b1509("EDAC: Poll timeout cannot be zero, p2") Signed-off-by: Eiichi Tsukata <devel@etsukata.com> Signed-off-by: Tony Luck <tony.luck@intel.com>
127 lines
4.5 KiB
C
127 lines
4.5 KiB
C
/* SPDX-License-Identifier: GPL-2.0 */
|
|
|
|
/*
|
|
* edac_module.h
|
|
*
|
|
* For defining functions/data for within the EDAC_CORE module only
|
|
*
|
|
* written by doug thompson <norsk5@xmission.h>
|
|
*/
|
|
|
|
#ifndef __EDAC_MODULE_H__
|
|
#define __EDAC_MODULE_H__
|
|
|
|
#include "edac_mc.h"
|
|
#include "edac_pci.h"
|
|
#include "edac_device.h"
|
|
|
|
/*
|
|
* INTERNAL EDAC MODULE:
|
|
* EDAC memory controller sysfs create/remove functions
|
|
* and setup/teardown functions
|
|
*
|
|
* edac_mc objects
|
|
*/
|
|
/* on edac_mc_sysfs.c */
|
|
int edac_mc_sysfs_init(void);
|
|
void edac_mc_sysfs_exit(void);
|
|
extern int edac_create_sysfs_mci_device(struct mem_ctl_info *mci,
|
|
const struct attribute_group **groups);
|
|
extern void edac_remove_sysfs_mci_device(struct mem_ctl_info *mci);
|
|
void edac_unregister_sysfs(struct mem_ctl_info *mci);
|
|
extern int edac_get_log_ue(void);
|
|
extern int edac_get_log_ce(void);
|
|
extern int edac_get_panic_on_ue(void);
|
|
extern int edac_mc_get_log_ue(void);
|
|
extern int edac_mc_get_log_ce(void);
|
|
extern int edac_mc_get_panic_on_ue(void);
|
|
extern int edac_get_poll_msec(void);
|
|
extern unsigned int edac_mc_get_poll_msec(void);
|
|
|
|
unsigned edac_dimm_info_location(struct dimm_info *dimm, char *buf,
|
|
unsigned len);
|
|
|
|
/* on edac_device.c */
|
|
extern int edac_device_register_sysfs_main_kobj(
|
|
struct edac_device_ctl_info *edac_dev);
|
|
extern void edac_device_unregister_sysfs_main_kobj(
|
|
struct edac_device_ctl_info *edac_dev);
|
|
extern int edac_device_create_sysfs(struct edac_device_ctl_info *edac_dev);
|
|
extern void edac_device_remove_sysfs(struct edac_device_ctl_info *edac_dev);
|
|
|
|
/* edac core workqueue: single CPU mode */
|
|
int edac_workqueue_setup(void);
|
|
void edac_workqueue_teardown(void);
|
|
bool edac_queue_work(struct delayed_work *work, unsigned long delay);
|
|
bool edac_stop_work(struct delayed_work *work);
|
|
bool edac_mod_work(struct delayed_work *work, unsigned long delay);
|
|
|
|
extern void edac_device_reset_delay_period(struct edac_device_ctl_info
|
|
*edac_dev, unsigned long value);
|
|
extern void edac_mc_reset_delay_period(unsigned long value);
|
|
|
|
extern void *edac_align_ptr(void **p, unsigned size, int n_elems);
|
|
|
|
/*
|
|
* EDAC debugfs functions
|
|
*/
|
|
|
|
#define edac_debugfs_remove_recursive debugfs_remove_recursive
|
|
#define edac_debugfs_remove debugfs_remove
|
|
#ifdef CONFIG_EDAC_DEBUG
|
|
void edac_debugfs_init(void);
|
|
void edac_debugfs_exit(void);
|
|
void edac_create_debugfs_nodes(struct mem_ctl_info *mci);
|
|
struct dentry *edac_debugfs_create_dir(const char *dirname);
|
|
struct dentry *
|
|
edac_debugfs_create_dir_at(const char *dirname, struct dentry *parent);
|
|
struct dentry *
|
|
edac_debugfs_create_file(const char *name, umode_t mode, struct dentry *parent,
|
|
void *data, const struct file_operations *fops);
|
|
void edac_debugfs_create_x8(const char *name, umode_t mode,
|
|
struct dentry *parent, u8 *value);
|
|
void edac_debugfs_create_x16(const char *name, umode_t mode,
|
|
struct dentry *parent, u16 *value);
|
|
#else
|
|
static inline void edac_debugfs_init(void) { }
|
|
static inline void edac_debugfs_exit(void) { }
|
|
static inline void edac_create_debugfs_nodes(struct mem_ctl_info *mci) { }
|
|
static inline struct dentry *edac_debugfs_create_dir(const char *dirname) { return NULL; }
|
|
static inline struct dentry *
|
|
edac_debugfs_create_dir_at(const char *dirname, struct dentry *parent) { return NULL; }
|
|
static inline struct dentry *
|
|
edac_debugfs_create_file(const char *name, umode_t mode, struct dentry *parent,
|
|
void *data, const struct file_operations *fops) { return NULL; }
|
|
static inline void edac_debugfs_create_x8(const char *name, umode_t mode,
|
|
struct dentry *parent, u8 *value) { }
|
|
static inline void edac_debugfs_create_x16(const char *name, umode_t mode,
|
|
struct dentry *parent, u16 *value) { }
|
|
#endif
|
|
|
|
/*
|
|
* EDAC PCI functions
|
|
*/
|
|
#ifdef CONFIG_PCI
|
|
extern void edac_pci_do_parity_check(void);
|
|
extern void edac_pci_clear_parity_errors(void);
|
|
extern int edac_sysfs_pci_setup(void);
|
|
extern void edac_sysfs_pci_teardown(void);
|
|
extern int edac_pci_get_check_errors(void);
|
|
extern int edac_pci_get_poll_msec(void);
|
|
extern void edac_pci_remove_sysfs(struct edac_pci_ctl_info *pci);
|
|
extern void edac_pci_handle_pe(struct edac_pci_ctl_info *pci, const char *msg);
|
|
extern void edac_pci_handle_npe(struct edac_pci_ctl_info *pci,
|
|
const char *msg);
|
|
#else /* CONFIG_PCI */
|
|
/* pre-process these away */
|
|
#define edac_pci_do_parity_check()
|
|
#define edac_pci_clear_parity_errors()
|
|
#define edac_sysfs_pci_setup() (0)
|
|
#define edac_sysfs_pci_teardown()
|
|
#define edac_pci_get_check_errors()
|
|
#define edac_pci_get_poll_msec()
|
|
#define edac_pci_handle_pe()
|
|
#define edac_pci_handle_npe()
|
|
#endif /* CONFIG_PCI */
|
|
|
|
#endif /* __EDAC_MODULE_H__ */
|