From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-19.0 required=3.0 tests=BAYES_00,INCLUDES_CR_TRAILER, INCLUDES_PATCH,MAILING_LIST_MULTI,MENTIONS_GIT_HOSTING,SPF_HELO_NONE,SPF_PASS autolearn=unavailable autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 3176BC433E0 for ; Thu, 7 Jan 2021 13:49:08 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id EDC4422AB9 for ; Thu, 7 Jan 2021 13:49:07 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1728128AbhAGNsw (ORCPT ); Thu, 7 Jan 2021 08:48:52 -0500 Received: from mail-ot1-f50.google.com ([209.85.210.50]:34719 "EHLO mail-ot1-f50.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1728167AbhAGNsw (ORCPT ); Thu, 7 Jan 2021 08:48:52 -0500 Received: by mail-ot1-f50.google.com with SMTP id a109so6314199otc.1; Thu, 07 Jan 2021 05:48:36 -0800 (PST) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=FxOc7uHglOoDfD1fFSW1c40P0G5PgpxQwefSb6uXKX0=; b=UGg5UZQVM3Gi3eSa+RqFiRAjA0wgmqpMLEiRDydpJ1RDflXwLZTe41E2UkIeTwCi8e xTrZ9uLl0rb+hJGJGiyyDurN1MJuVrfDxKVeUMgL1i2y63VoPCg4PE4ef1LBFnxSSF3U KEgWVHF5BhQUtFEJuM5qqtUFjhdH3KIx84gCt8fprQEoXB3UY5Vs8FSHjSb06rhjDYoh b9Wy02YPn/wLDG7kB5WCaNITGOdyQPEd11LC4vqys5+cxrk7RHKLLlOhDJhqqWiy8OW5 tyuCh0Py8IC0wcd08cPbp/JXQY2drkeYFwYYb3aKFHHgsR6DSq3j9rbEnGIIESoUj0XL UiAQ== X-Gm-Message-State: AOAM530XbL94yaYQbqD8Hy3dTrXjXu+SYS5llrkPc7EzL2Sm39GPoQof 4WSSDUOU+wtyARYkZxWZEPHXm6Pe/ppBf6kV5xE= X-Google-Smtp-Source: ABdhPJyeJqQC2tPO8m/QCgSqmxuUOkbOdB4YBKAgAsShfPvmNBRfDYkobds4iz78u9E8W5YARno4ZTrC0ocfJuWSqzs= X-Received: by 2002:a9d:208a:: with SMTP id x10mr6538983ota.260.1610027290930; Thu, 07 Jan 2021 05:48:10 -0800 (PST) MIME-Version: 1.0 References: <20201218040826.57203-1-decui@microsoft.com> In-Reply-To: From: "Rafael J. Wysocki" Date: Thu, 7 Jan 2021 14:47:34 +0100 Message-ID: Subject: Re: [PATCH] ACPI: scan: Fix a Hyper-V Linux VM panic caused by buffer overflow To: Dexuan Cui Cc: Michael Kelley , "linux-acpi@vger.kernel.org" , "rjw@rjwysocki.net" , "len.brown@intel.com" , "wei.liu@kernel.org" , "linux-kernel@vger.kernel.org" , Stephen Hemminger , Haiyang Zhang , KY Srinivasan Content-Type: text/plain; charset="UTF-8" Precedence: bulk List-ID: X-Mailing-List: linux-acpi@vger.kernel.org On Tue, Jan 5, 2021 at 11:02 PM Dexuan Cui wrote: > > > From: Michael Kelley > > Sent: Tuesday, December 22, 2020 5:56 AM > > From: Dexuan Cui > > Sent: Thursday, December 17, 2020 > > 8:08 PM > > > > > > Linux VM on Hyper-V crashes with the latest mainline: > > > ... > > > --- a/drivers/acpi/scan.c > > > +++ b/drivers/acpi/scan.c > > > @@ -674,7 +674,8 @@ int acpi_device_add(struct acpi_device *device, > > > } > > > if (!found) { > > > acpi_device_bus_id = new_bus_id; > > > - strcpy(acpi_device_bus_id->bus_id, acpi_device_hid(device)); > > > + strlcpy(acpi_device_bus_id->bus_id, acpi_device_hid(device), > > > + sizeof(acpi_device_bus_id->bus_id)); > > > acpi_device_bus_id->instance_no = 0; > > > list_add_tail(&acpi_device_bus_id->node, &acpi_bus_id_list); > > > } > > > > Reviewed-by: Michael Kelley > > Hi, ACPI maintainers, > Would you please take a look at the small fix? Currently the mainline Linux > kernel, running in a VM on Hyper-V, has been broken for almost 3 weeks, > i.e. the VM always panics when it boots. The root cause is a VM issue AFAICS, though. > The patch has already had Michael's Reviewed-by. > > BTW, the patch should have a stable tag: > Cc: > > Or, do you want the patch to go through the Hyper-V tree? > https://git.kernel.org/pub/scm/linux/kernel/git/hyperv/linux.git/log/?h=hyperv-fixes > > The small patch is unlikely to cause a merge conflict, and it only affects > Linux VMs on Hyper-V so far. It doesn't look like the right fix to me, though. The problem appears to be that the string coming from _HID is too long (which is a spec violation). The patch truncates it to match the length of the target buffer, but that is not particularly useful. It would be better to use something like kstrdup_const() to initialize acpi_device_bus_id->bus_id IMV.