From: Phil Oester <kernel@linuxace.com>
To: Arnd Bergmann <arnd@arndb.de>
Cc: Kashyap Desai <kashyap.desai@broadcom.com>,
Sumit Saxena <sumit.saxena@broadcom.com>,
Shivasharan S <shivasharan.srikanteshwara@broadcom.com>,
"James E.J. Bottomley" <jejb@linux.ibm.com>,
"Martin K. Petersen" <martin.petersen@oracle.com>,
hch@infradead.org, Arnd Bergmann <arnd@arndb.de>,
stable@vger.kernel.org,
Anand Lodnoor <anand.lodnoor@broadcom.com>,
Chandrakanth Patil <chandrakanth.patil@broadcom.com>,
Hannes Reinecke <hare@suse.de>,
megaraidlinux.pdl@broadcom.com, linux-scsi@vger.kernel.org,
linux-kernel@vger.kernel.org
Subject: Re: [PATCH 2/3] scsi: megaraid_sas: check user-provided offsets
Date: Wed, 30 Dec 2020 16:15:53 -0800 [thread overview]
Message-ID: <20201231001553.GB16945@home.linuxace.com> (raw)
In-Reply-To: <20200908213715.3553098-2-arnd@arndb.de>
On Tue, Sep 08, 2020 at 11:36:22PM +0200, Arnd Bergmann wrote:
> It sounds unwise to let user space pass an unchecked 32-bit
> offset into a kernel structure in an ioctl. This is an unsigned
> variable, so checking the upper bound for the size of the structure
> it points into is sufficient to avoid data corruption, but as
> the pointer might also be unaligned, it has to be written carefully
> as well.
>
> While I stumbled over this problem by reading the code, I did not
> continue checking the function for further problems like it.
Sorry for replying to an ancient thread, but this patch just recently
made it into 5.10.3 and has caused unintended consequences. On Dell
servers with PERC RAID controllers, booting 5.10.3+ with this patch
causes a PCI parity error. Specifically:
Event Message: A PCI parity error was detected on a component at bus 0 device 5 function 0.
Severity: Critical
Message ID: PCI1308
I reverted this single patch and the errors went away.
Thoughts?
Phil Oester
next prev parent reply other threads:[~2020-12-31 0:16 UTC|newest]
Thread overview: 20+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-09-08 21:36 [PATCH 1/3] scsi: aacraid: improve compat_ioctl handlers Arnd Bergmann
2020-09-08 21:36 ` [PATCH 2/3] scsi: megaraid_sas: check user-provided offsets Arnd Bergmann
2020-09-12 7:20 ` Christoph Hellwig
2020-09-12 17:03 ` Arnd Bergmann
2020-12-31 0:15 ` Phil Oester [this message]
2021-01-03 16:26 ` Arnd Bergmann
2021-01-03 17:00 ` James Bottomley
2021-01-03 18:49 ` Arnd Bergmann
2021-01-03 20:12 ` James Bottomley
2021-01-04 17:48 ` Phil Oester
2021-01-04 22:24 ` Arnd Bergmann
2020-09-08 21:36 ` [PATCH 3/3] scsi: megaraid_sas: simplify compat_ioctl handling Arnd Bergmann
2020-09-12 7:47 ` Christoph Hellwig
2020-09-12 12:49 ` Arnd Bergmann
2020-09-13 6:50 ` compat_alloc_user_space removal, was " Christoph Hellwig
2020-09-13 11:46 ` Arnd Bergmann
2020-09-17 14:55 ` Arnd Bergmann
2020-09-17 14:57 ` Christoph Hellwig
2020-09-12 7:09 ` [PATCH 1/3] scsi: aacraid: improve compat_ioctl handlers Christoph Hellwig
2020-09-17 15:02 ` Arnd Bergmann
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20201231001553.GB16945@home.linuxace.com \
--to=kernel@linuxace.com \
--cc=anand.lodnoor@broadcom.com \
--cc=arnd@arndb.de \
--cc=chandrakanth.patil@broadcom.com \
--cc=hare@suse.de \
--cc=hch@infradead.org \
--cc=jejb@linux.ibm.com \
--cc=kashyap.desai@broadcom.com \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-scsi@vger.kernel.org \
--cc=martin.petersen@oracle.com \
--cc=megaraidlinux.pdl@broadcom.com \
--cc=shivasharan.srikanteshwara@broadcom.com \
--cc=stable@vger.kernel.org \
--cc=sumit.saxena@broadcom.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).