linux-kernel - Re: [PATCH] dell-wmi: Stop storing pointers to DMI tables

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Fri, 15 Jan 2016 08:27:59 -0800
From:	Andy Lutomirski <luto@...capital.net>
To:	Jean Delvare <jdelvare@...e.de>
Cc:	Pali Rohár <pali.rohar@...il.com>,
	Jean Delvare <jdelvare@...e.com>,
	Andy Lutomirski <luto@...nel.org>,
	platform-driver-x86@...r.kernel.org,
	"linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>,
	stable <stable@...r.kernel.org>
Subject: Re: [PATCH] dell-wmi: Stop storing pointers to DMI tables

On Fri, Jan 15, 2016 at 5:27 AM, Jean Delvare <jdelvare@...e.de> wrote:
> Hi Andy,
>
> Sorry for the late reply.
>
> On Wed, 13 Jan 2016 14:28:18 -0800, Andy Lutomirski wrote:
>> [cc: Jean Delvare]
>>
>> On Tue, Jan 12, 2016 at 6:25 AM, Pali Rohár <pali.rohar@...il.com> wrote:
>> > On Monday 11 January 2016 13:58:20 Andy Lutomirski wrote:
>> >> On Sun, Jan 3, 2016 at 6:52 AM, Andy Lutomirski <luto@...nel.org> wrote:
>> >> > The dmi_walk function maps the DMI table, walks it, and unmaps it.
>> >> > This means that the dell_bios_hotkey_table that find_hk_type stores
>> >> > points to unmapped memory by the time it gets read.
>> >> >
>> >> > I've been able to trigger crashes caused by the stale pointer a
>> >> > couple of times, but never on a stock kernel.
>> >> >
>> >> > Fix it by generating the keymap in the dmi_walk callback instead of
>> >> > storing a pointer.
>> >>
>> >> Quick ping: has anyone had a chance to look at this?
>> >
>> > Hi Andy, I looked at this patch, but I think some people from -mm or DMI
>> > code should look at it as it is memory problem... We also has one in
>> > dell-laptop.ko (wrong API usage) and so -mm people could know it better.
>>
>> Let's ask:
>>
>> Jean, am I right that drivers must not store pointers to DMI tables
>> that they find through dmi_walk?
>
> Yes, you are right.
>
>> Is there any alternative interface
>> that could be used to get a longer-lived pointer to DMI tables, or
>> should drivers just parse them and copy out any info needed from the
>> dmi_walk callback?
>
> There is no alternative for OEM type records. Drivers are indeed
> expected to copy the information they need to their own buffers.

FWIW, especially if we consider mapping it persistently, maybe we
should use ioremap_prot and map it both cached and ro.

Actually, switching to a cached mapping regardless of persistence
could noticeably help boot times.  UC accesses are very, very slow.

--Andy