]>
Commit | Line | Data |
---|---|---|
69c3e91f GKH |
1 | From 286e87718103acdf85f4ed323a37e4839a8a7c05 Mon Sep 17 00:00:00 2001 |
2 | From: Vishal Verma <vishal.l.verma@intel.com> | |
3 | Date: Fri, 10 Aug 2018 13:23:15 -0600 | |
4 | Subject: libnvdimm: fix ars_status output length calculation | |
5 | ||
6 | From: Vishal Verma <vishal.l.verma@intel.com> | |
7 | ||
8 | commit 286e87718103acdf85f4ed323a37e4839a8a7c05 upstream. | |
9 | ||
10 | Commit efda1b5d87cb ("acpi, nfit, libnvdimm: fix / harden ars_status output length handling") | |
11 | Introduced additional hardening for ambiguity in the ACPI spec for | |
12 | ars_status output sizing. However, it had a couple of cases mixed up. | |
13 | Where it should have been checking for (and returning) "out_field[1] - | |
14 | 4" it was using "out_field[1] - 8" and vice versa. | |
15 | ||
16 | This caused a four byte discrepancy in the buffer size passed on to | |
17 | the command handler, and in some cases, this caused memory corruption | |
18 | like: | |
19 | ||
20 | ./daxdev-errors.sh: line 76: 24104 Aborted (core dumped) ./daxdev-errors $busdev $region | |
21 | malloc(): memory corruption | |
22 | Program received signal SIGABRT, Aborted. | |
23 | [...] | |
24 | #5 0x00007ffff7865a2e in calloc () from /lib64/libc.so.6 | |
25 | #6 0x00007ffff7bc2970 in ndctl_bus_cmd_new_ars_status (ars_cap=ars_cap@entry=0x6153b0) at ars.c:136 | |
26 | #7 0x0000000000401644 in check_ars_status (check=0x7fffffffdeb0, bus=0x604c20) at daxdev-errors.c:144 | |
27 | #8 test_daxdev_clear_error (region_name=<optimized out>, bus_name=<optimized out>) | |
28 | at daxdev-errors.c:332 | |
29 | ||
30 | Cc: <stable@vger.kernel.org> | |
31 | Cc: Dave Jiang <dave.jiang@intel.com> | |
32 | Cc: Keith Busch <keith.busch@intel.com> | |
33 | Cc: Lukasz Dorau <lukasz.dorau@intel.com> | |
34 | Cc: Dan Williams <dan.j.williams@intel.com> | |
35 | Fixes: efda1b5d87cb ("acpi, nfit, libnvdimm: fix / harden ars_status output length handling") | |
36 | Signed-off-by: Vishal Verma <vishal.l.verma@intel.com> | |
37 | Reviewed-by: Keith Busch <keith.busch@intel.com> | |
38 | Signed-of-by: Dave Jiang <dave.jiang@intel.com> | |
39 | Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> | |
40 | ||
41 | --- | |
42 | drivers/nvdimm/bus.c | 4 ++-- | |
43 | 1 file changed, 2 insertions(+), 2 deletions(-) | |
44 | ||
45 | --- a/drivers/nvdimm/bus.c | |
46 | +++ b/drivers/nvdimm/bus.c | |
47 | @@ -808,9 +808,9 @@ u32 nd_cmd_out_size(struct nvdimm *nvdim | |
48 | * overshoots the remainder by 4 bytes, assume it was | |
49 | * including 'status'. | |
50 | */ | |
51 | - if (out_field[1] - 8 == remainder) | |
52 | + if (out_field[1] - 4 == remainder) | |
53 | return remainder; | |
54 | - return out_field[1] - 4; | |
55 | + return out_field[1] - 8; | |
56 | } else if (cmd == ND_CMD_CALL) { | |
57 | struct nd_cmd_pkg *pkg = (struct nd_cmd_pkg *) in_field; | |
58 |