linux-kernel - Re: [Bugfix v4] PCI, ACPI: Fix regressions caused by resource_size

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Fri, 10 Jul 2015 03:10:18 +0200
From:	"Rafael J. Wysocki" <rjw@...ysocki.net>
To:	Jiang Liu <jiang.liu@...ux.intel.com>
Cc:	Bjorn Helgaas <bhelgaas@...gle.com>,
	Ingo Molnar <mingo@...nel.org>,
	Boszormenyi Zoltan <zboszor@...hu>,
	Len Brown <lenb@...nel.org>,
	LKML <linux-kernel@...r.kernel.org>, linux-pci@...r.kernel.org,
	linux-acpi@...r.kernel.org, "x86 @ kernel . org" <x86@...nel.org>
Subject: Re: [Bugfix v4] PCI, ACPI: Fix regressions caused by resource_size_t overflow with 32-bit kernel

On Wednesday, July 08, 2015 03:26:39 PM Jiang Liu wrote:
> Zoltan Boszormenyi reported this regression:
>   "There's a Realtek RTL8111/8168/8411 (PCI ID 10ec:8168, Subsystem ID
>    1565:230e) network chip on the mainboard. After the r8169 driver loaded
>    the IRQs in the machine went berserk. Keyboard keypressed arrived with
>    considerable latency and duplicated, so no real work was possible.
>    The machine responded to the power button but didn't actually power
>    down. It just stuck at the powering down message. I had to press the
>    power button for 4 seconds to power it down.
> 
>    The computer is a POS machine with a big battery inside. Because of this,
>    either ACPI or the Realtek chip kept the bad state and after rebooting,
>    the network chip didn't even show up in lspci. Not even the PXE ROM
>    announced itself during boot. I had to disconnect the battery to beat
>    some sense back to the computer.
> 
>    The regression happens with 4.0.5, 4.1.0-rc8 and 4.1.0-final. 3.18.16 was
>    good."
> 
> The regression is caused by commit 593669c2ac0f ("x86/PCI/ACPI: Use common
> ACPI resource interfaces to simplify implementation"). Since commit
> 593669c2ac0f, x86 PCI ACPI host bridge driver validates ACPI resources by
> first converting an ACPI resource to a 'struct resource' structure and
> then applying checks against the converted resource structure. The 'start'
> and 'end' fields in 'struct resource' are defined to be type of
> resource_size_t, which may be 32 bits or 64 bits depending on
> CONFIG_PHYS_ADDR_T_64BIT.
> 
> This may cause incorrect resource validation results with 32-bit kernels
> because 64-bit ACPI resource descriptors may get truncated when converting
> to 32-bit 'start' and 'end' fields in 'struct resource'. It eventually
> affects PCI resource allocation subsystem and makes some PCI devices and
> the system behave abnormally due to incorrect resource assignment.
> 
> So enhance the ACPI resource parsing interfaces to ignore ACPI resource
> descriptors with address/offset above 4G when running in 32-bit mode.
> 
> With the fix applied, the behavior of the machine was restored to how
> 3.18.16 worked, i.e. the memory range that is over 4GB is ignored again,
> and lspci -vvxxx shows that everything is at the same memory window as
> they were with 3.18.16.
> 
> Reported-and-Tested-by: Boszormenyi Zoltan <zboszor@...hu>
> Fixes: 593669c2ac0f ("x86/PCI/ACPI: Use common ACPI resource interfaces to simplify implementation")
> Signed-off-by: Jiang Liu <jiang.liu@...ux.intel.com>
> Cc: stable@...r.kernel.org # 4.0

OK, I'm happy with the above changelog, so I'm going to apply the patch.

If anyone has any objections, please let me know.

Thanks,
Rafael

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/