From: Dave Jiang <dave.jiang@intel.com>
To: Vishal Verma <vishal.l.verma@intel.com>, linux-nvdimm@lists.01.org
Cc: stable@vger.kernel.org
Subject: Re: [PATCH] libnvdimm: fix ars_status output length calculation
Date: Fri, 10 Aug 2018 12:54:47 -0700 [thread overview]
Message-ID: <996c7e5e-8472-aa44-0a27-abfdd6b3c86e@intel.com> (raw)
In-Reply-To: <20180810192315.3471-1-vishal.l.verma@intel.com>
On 08/10/2018 12:23 PM, Vishal Verma wrote:
> Commit efda1b5d87cb ("acpi, nfit, libnvdimm: fix / harden ars_status output length handling")
> Introduced additional hardening for ambiguity in the ACPI spec for
> ars_status output sizing. However, it had a couple of cases mixed up.
> Where it should have been checking for (and returning) "out_field[1] -
> 4" it was using "out_field[1] - 8" and vice versa.
>
> This caused a four byte discrepancy in the buffer size passed on to
> the command handler, and in some cases, this caused memory corruption
> like:
>
> ./daxdev-errors.sh: line 76: 24104 Aborted (core dumped) ./daxdev-errors $busdev $region
> malloc(): memory corruption
> Program received signal SIGABRT, Aborted.
> [...]
> #5 0x00007ffff7865a2e in calloc () from /lib64/libc.so.6
> #6 0x00007ffff7bc2970 in ndctl_bus_cmd_new_ars_status (ars_cap=ars_cap@entry=0x6153b0) at ars.c:136
> #7 0x0000000000401644 in check_ars_status (check=0x7fffffffdeb0, bus=0x604c20) at daxdev-errors.c:144
> #8 test_daxdev_clear_error (region_name=<optimized out>, bus_name=<optimized out>)
> at daxdev-errors.c:332
>
> Cc: <stable@vger.kernel.org>
> Cc: Dave Jiang <dave.jiang@intel.com>
> Cc: Keith Busch <keith.busch@intel.com>
> Cc: Lukasz Dorau <lukasz.dorau@intel.com>
> Cc: Dan Williams <dan.j.williams@intel.com>
> Fixes: efda1b5d87cb ("acpi, nfit, libnvdimm: fix / harden ars_status output length handling")
> Signed-off-by: Vishal Verma <vishal.l.verma@intel.com>
Applied.
> ---
> drivers/nvdimm/bus.c | 4 ++--
> 1 file changed, 2 insertions(+), 2 deletions(-)
>
> diff --git a/drivers/nvdimm/bus.c b/drivers/nvdimm/bus.c
> index 27902a8799b1..8aae6dcc839f 100644
> --- a/drivers/nvdimm/bus.c
> +++ b/drivers/nvdimm/bus.c
> @@ -812,9 +812,9 @@ u32 nd_cmd_out_size(struct nvdimm *nvdimm, int cmd,
> * overshoots the remainder by 4 bytes, assume it was
> * including 'status'.
> */
> - if (out_field[1] - 8 == remainder)
> + if (out_field[1] - 4 == remainder)
> return remainder;
> - return out_field[1] - 4;
> + return out_field[1] - 8;
> } else if (cmd == ND_CMD_CALL) {
> struct nd_cmd_pkg *pkg = (struct nd_cmd_pkg *) in_field;
>
>
_______________________________________________
Linux-nvdimm mailing list
Linux-nvdimm@lists.01.org
https://lists.01.org/mailman/listinfo/linux-nvdimm
prev parent reply other threads:[~2018-08-10 19:54 UTC|newest]
Thread overview: 3+ messages / expand[flat|nested] mbox.gz Atom feed top
2018-08-10 19:23 [PATCH] libnvdimm: fix ars_status output length calculation Vishal Verma
2018-08-10 19:28 ` Keith Busch
2018-08-10 19:54 ` Dave Jiang [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=996c7e5e-8472-aa44-0a27-abfdd6b3c86e@intel.com \
--to=dave.jiang@intel.com \
--cc=linux-nvdimm@lists.01.org \
--cc=stable@vger.kernel.org \
--cc=vishal.l.verma@intel.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).