linux-kernel - Re: [PATCH v2 1/2] PCI ACPI: Avoid panic when PCI IO resource's size is not page aligned

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Tue, 8 May 2018 23:20:23 +0200
From:   "Rafael J. Wysocki" <rafael@...nel.org>
To:     Yisheng Xie <xieyisheng1@...wei.com>
Cc:     "Rafael J. Wysocki" <rjw@...ysocki.net>,
        Bjorn Helgaas <bhelgaas@...gle.com>,
        Len Brown <lenb@...nel.org>,
        Linux PCI <linux-pci@...r.kernel.org>,
        ACPI Devel Maling List <linux-acpi@...r.kernel.org>,
        Linux Kernel Mailing List <linux-kernel@...r.kernel.org>,
        Hanjun Guo <guohanjun@...wei.com>,
        Jon Masters <jcm@...hat.com>, Toshi Kani <toshi.kani@....com>,
        tanxiaojun@...wei.com, Zhou Wang <wangzhou1@...ilicon.com>,
        Lorenzo Pieralisi <lorenzo.pieralisi@....com>,
        Sudeep Holla <sudeep.holla@....com>,
        Hanjun Guo <hanjun.guo@...aro.org>
Subject: Re: [PATCH v2 1/2] PCI ACPI: Avoid panic when PCI IO resource's size
 is not page aligned

On Mon, May 7, 2018 at 10:06 AM, Yisheng Xie <xieyisheng1@...wei.com> wrote:
>
>
> On 2018/5/1 17:28, Rafael J. Wysocki wrote:
>>>  drivers/acpi/pci_root.c | 2 +-
>>> >  1 file changed, 1 insertion(+), 1 deletion(-)
>>> >
>>> > diff --git a/drivers/acpi/pci_root.c b/drivers/acpi/pci_root.c
>>> > index 6fc204a..b758ca3 100644
>>> > --- a/drivers/acpi/pci_root.c
>>> > +++ b/drivers/acpi/pci_root.c
>>> > @@ -746,7 +746,7 @@ static void acpi_pci_root_remap_iospace(struct resource_entry *entry)
>>> >            goto err;
>>> >
>>> >    res->start = port;
>>> > -  res->end = port + length - 1;
>>> > +  res->end = PAGE_ALIGN(port + length) - 1;
>> Shouldn't pci_remap_iospace() sanitize its arguments instead?
>
> Yeah, I thought that pci_remap_iospace() will be called at many place, and presently I
> had not seen any problem at other place except acpi_pci_root_remap_iospace(). Anyway,
> sanitize arguments in pci_remap_iospace() can resolve the problem more thoroughly, but
> should more common, right?
>
> Therefore, is the follow change ok from your point of view?
>
> diff --git a/drivers/pci/pci.c b/drivers/pci/pci.c
> index e597655..8607298 100644
> --- a/drivers/pci/pci.c
> +++ b/drivers/pci/pci.c
> @@ -3527,6 +3527,9 @@ int pci_remap_iospace(const struct resource *res, phys_addr_t phys_addr)
>         if (res->end > IO_SPACE_LIMIT)
>                 return -EINVAL;
>
> +       if (!PAGE_ALIGNED(vaddr) || !PAGE_ALIGNED(resource_size(res)))
> +               return -EINVAL;
> +
>         return ioremap_page_range(vaddr, vaddr + resource_size(res), phys_addr,
>                                   pgprot_device(PAGE_KERNEL));
>  #else

I'd rather apply PAGE_ALIGN() to the arguments of ioremap_page_range()
and call it anyway.  It will fail if the mapping cannot be created.