linux-kernel - Re: [PATCH] platform/x86: intel_pmc_core: fix out-of-bounds accesses on stack

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Fri, 27 Jan 2017 19:31:47 +0300
From:   Andrey Ryabinin <aryabinin@...tuozzo.com>
To:     Andy Shevchenko <andy.shevchenko@...il.com>
CC:     Rajneesh Bhardwaj <rajneesh.bhardwaj@...el.com>,
        Vishwanath Somayaji <vishwanath.somayaji@...el.com>,
        Darren Hart <dvhart@...radead.org>,
        "Andy Shevchenko" <andy@...radead.org>,
        Platform Driver <platform-driver-x86@...r.kernel.org>,
        "linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>
Subject: Re: [PATCH] platform/x86: intel_pmc_core: fix out-of-bounds accesses
 on stack



On 01/27/2017 06:42 PM, Andy Shevchenko wrote:
> On Thu, Jan 26, 2017 at 4:27 PM, Andrey Ryabinin
> <aryabinin@...tuozzo.com> wrote:


>>  #if IS_ENABLED(CONFIG_DEBUG_FS)
>> @@ -234,12 +230,8 @@ static const struct file_operations pmc_core_ppfear_ops = {
>>  /* This function should return link status, 0 means ready */
>>  static int pmc_core_mtpmc_link_status(void)
>>  {
>> -       struct pmc_dev *pmcdev = &pmc;
>> -       u32 value;
>> -
>> -       value = pmc_core_reg_read(pmcdev, SPT_PMC_PM_STS_OFFSET);
>> -       return test_bit(SPT_PMC_MSG_FULL_STS_BIT,
>> -                       (unsigned long *)&value);
>> +       u32 value = pmc_core_reg_read(&pmc, SPT_PMC_PM_STS_OFFSET);
>> +       return value & (1U << SPT_PMC_MSG_FULL_STS_BIT);
>>  }
> 
> Thanks for the patch. IIRC I told (or may be forgot to tell) them
> during internal review about the nasty casting.
> 
> Btw, have you checked this will work in the same way, since test_bit()
> is atomic?

'value' is a local variable, atomicity is pointless here.

> And if it's okay, why not to use BIT() macro?
> 

It just a matter of taste. I find open-coded variant easier to read.