linux-kernel.vger.kernel.org archive mirror
 help / color / mirror / Atom feed
From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: linux-kernel@vger.kernel.org
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
	stable@vger.kernel.org, Dan Williams <dan.j.williams@intel.com>
Subject: [PATCH 4.8 18/33] acpi, nfit: validate ars_status output buffer size
Date: Tue, 13 Dec 2016 09:16:19 -0800	[thread overview]
Message-ID: <20161213171534.933799315@linuxfoundation.org> (raw)
In-Reply-To: <20161213171534.171564506@linuxfoundation.org>

4.8-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Dan Williams <dan.j.williams@intel.com>

commit 82aa37cf09867c5e2c0326649d570e5b25c1189a upstream.

If an ARS Status command returns truncated output, do not process
partial records or otherwise consume non-status fields.

Fixes: 0caeef63e6d2 ("libnvdimm: Add a poison list and export badblocks")
Signed-off-by: Dan Williams <dan.j.williams@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/acpi/nfit/core.c |   21 +++++++++++++++++----
 1 file changed, 17 insertions(+), 4 deletions(-)

--- a/drivers/acpi/nfit/core.c
+++ b/drivers/acpi/nfit/core.c
@@ -146,7 +146,8 @@ static int xlat_status(void *buf, unsign
 		 * then just continue with the returned results.
 		 */
 		if (status == NFIT_ARS_STATUS_INTR) {
-			if (ars_status->flags & NFIT_ARS_F_OVERFLOW)
+			if (ars_status->out_length >= 40 && (ars_status->flags
+						& NFIT_ARS_F_OVERFLOW))
 				return -ENOSPC;
 			return 0;
 		}
@@ -1858,19 +1859,32 @@ static int ars_get_status(struct acpi_nf
 	return cmd_rc;
 }
 
-static int ars_status_process_records(struct nvdimm_bus *nvdimm_bus,
+static int ars_status_process_records(struct acpi_nfit_desc *acpi_desc,
 		struct nd_cmd_ars_status *ars_status)
 {
+	struct nvdimm_bus *nvdimm_bus = acpi_desc->nvdimm_bus;
 	int rc;
 	u32 i;
 
+	/*
+	 * First record starts at 44 byte offset from the start of the
+	 * payload.
+	 */
+	if (ars_status->out_length < 44)
+		return 0;
 	for (i = 0; i < ars_status->num_records; i++) {
+		/* only process full records */
+		if (ars_status->out_length
+				< 44 + sizeof(struct nd_ars_record) * (i + 1))
+			break;
 		rc = nvdimm_bus_add_poison(nvdimm_bus,
 				ars_status->records[i].err_address,
 				ars_status->records[i].length);
 		if (rc)
 			return rc;
 	}
+	if (i < ars_status->num_records)
+		dev_warn(acpi_desc->dev, "detected truncated ars results\n");
 
 	return 0;
 }
@@ -2123,8 +2137,7 @@ static int acpi_nfit_query_poison(struct
 	if (rc < 0 && rc != -ENOSPC)
 		return rc;
 
-	if (ars_status_process_records(acpi_desc->nvdimm_bus,
-				acpi_desc->ars_status))
+	if (ars_status_process_records(acpi_desc, acpi_desc->ars_status))
 		return -ENOMEM;
 
 	return 0;

  parent reply	other threads:[~2016-12-13 17:16 UTC|newest]

Thread overview: 36+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
     [not found] <CGME20161213171629epcas1p4dc2737fb27df6f1d6148edf348dde1c7@epcas1p4.samsung.com>
2016-12-13 17:16 ` [PATCH 4.8 00/33] 4.8.15-stable review Greg Kroah-Hartman
2016-12-13 17:16   ` [PATCH 4.8 01/33] powerpc/eeh: Fix deadlock when PE frozen state cant be cleared Greg Kroah-Hartman
2016-12-13 17:16   ` [PATCH 4.8 02/33] powerpc/mm: Fix lazy icache flush on pre-POWER5 Greg Kroah-Hartman
2016-12-13 17:16   ` [PATCH 4.8 03/33] powerpc/boot: Fix build failure in 32-bit boot wrapper Greg Kroah-Hartman
2016-12-13 17:16   ` [PATCH 4.8 04/33] fuse: fix clearing suid, sgid for chown() Greg Kroah-Hartman
2016-12-13 17:16   ` [PATCH 4.8 05/33] parisc: Purge TLB before setting PTE Greg Kroah-Hartman
2016-12-13 17:16   ` [PATCH 4.8 06/33] parisc: Remove unnecessary TLB purges from flush_dcache_page_asm and flush_icache_page_asm Greg Kroah-Hartman
2016-12-13 17:16   ` [PATCH 4.8 07/33] parisc: Fix TLB related boot crash on SMP machines Greg Kroah-Hartman
2016-12-13 17:16   ` [PATCH 4.8 08/33] zram: restrict add/remove attributes to root only Greg Kroah-Hartman
2016-12-13 17:16   ` [PATCH 4.8 09/33] locking/rtmutex: Prevent dequeue vs. unlock race Greg Kroah-Hartman
2016-12-13 17:16   ` [PATCH 4.8 10/33] locking/rtmutex: Use READ_ONCE() in rt_mutex_owner() Greg Kroah-Hartman
2016-12-13 17:16   ` [PATCH 4.8 11/33] device-dax: fix private mapping restriction, permit read-only Greg Kroah-Hartman
2016-12-13 17:16   ` [PATCH 4.8 12/33] scsi: lpfc: fix oops/BUG in lpfc_sli_ringtxcmpl_put() Greg Kroah-Hartman
2016-12-13 17:16   ` [PATCH 4.8 13/33] sched/autogroup: Fix 64-bit kernel nice level adjustment Greg Kroah-Hartman
2016-12-13 17:16   ` [PATCH 4.8 14/33] vhost-vsock: fix orphan connection reset Greg Kroah-Hartman
2016-12-13 17:16   ` [PATCH 4.8 15/33] perf/x86: Fix full width counter, counter overflow Greg Kroah-Hartman
2016-12-13 17:16   ` [PATCH 4.8 16/33] acpi, nfit: fix extended status translations for ACPI DSMs Greg Kroah-Hartman
2016-12-13 17:16   ` [PATCH 4.8 17/33] acpi, nfit, libnvdimm: fix / harden ars_status output length handling Greg Kroah-Hartman
2016-12-13 17:16   ` Greg Kroah-Hartman [this message]
2016-12-13 17:16   ` [PATCH 4.8 19/33] acpi, nfit: fix bus vs dimm confusion in xlat_status Greg Kroah-Hartman
2016-12-13 17:16   ` [PATCH 4.8 20/33] crypto: marvell - Dont copy hash operation twice into the SRAM Greg Kroah-Hartman
2016-12-13 17:16   ` [PATCH 4.8 22/33] crypto: mcryptd - Check mcryptd algorithm compatibility Greg Kroah-Hartman
2016-12-13 17:16   ` [PATCH 4.8 23/33] crypto: marvell - Dont corrupt state of an STD req for re-stepped ahash Greg Kroah-Hartman
2016-12-13 17:16   ` [PATCH 4.8 24/33] can: raw: raw_setsockopt: limit number of can_filter that can be set Greg Kroah-Hartman
2016-12-13 17:16   ` [PATCH 4.8 26/33] Revert "ACPI: Execute _PTS before system reboot" Greg Kroah-Hartman
2016-12-13 17:16   ` [PATCH 4.8 27/33] ARM: dts: orion5x: fix number of sata port for linkstation ls-gl Greg Kroah-Hartman
2016-12-13 17:16   ` [PATCH 4.8 28/33] ARM: dts: imx7d: fix LCDIF clock assignment Greg Kroah-Hartman
2016-12-13 17:16   ` [PATCH 4.8 29/33] ceph: dont set req->r_locked_dir in ceph_d_revalidate Greg Kroah-Hartman
2016-12-13 17:16   ` [PATCH 4.8 30/33] m68k: Fix ndelay() macro Greg Kroah-Hartman
2016-12-13 17:16   ` [PATCH 4.8 31/33] batman-adv: Check for alloc errors when preparing TT local data Greg Kroah-Hartman
2016-12-13 17:16   ` [PATCH 4.8 32/33] hotplug: Make register and unregister notifier API symmetric Greg Kroah-Hartman
2016-12-13 17:16   ` [PATCH 4.8 33/33] crypto: rsa - Add Makefile dependencies to fix parallel builds Greg Kroah-Hartman
2016-12-13 19:32   ` [PATCH 4.8 00/33] 4.8.15-stable review Shuah Khan
2016-12-13 20:07     ` Greg Kroah-Hartman
2016-12-14  4:13   ` Guenter Roeck
2016-12-14 12:49     ` Greg Kroah-Hartman

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20161213171534.933799315@linuxfoundation.org \
    --to=gregkh@linuxfoundation.org \
    --cc=dan.j.williams@intel.com \
    --cc=linux-kernel@vger.kernel.org \
    --cc=stable@vger.kernel.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).