linux-kernel - Re: [PATCH 3/3] x86,pci,acpi: Handle invalid

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Wed, 21 Apr 2010 17:02:35 -0700
From:	"H. Peter Anvin" <hpa@...or.com>
To:	Yinghai <yinghai.lu@...cle.com>
CC:	Bjorn Helgaas <bjorn.helgaas@...com>,
	Thomas Gleixner <tglx@...utronix.de>,
	Ingo Molnar <mingo@...hat.com>,
	Jesse Barnes <jbarnes@...tuousgeek.org>,
	Andy Isaacson <adi@...apodia.org>, guenter.roeck@...csson.com,
	Linus Torvalds <torvalds@...ux-foundation.org>,
	"linux-pci@...r.kernel.org" <linux-pci@...r.kernel.org>,
	"x86@...nel.org" <x86@...nel.org>,
	"linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>,
	Thomas Renninger <trenn@...e.de>,
	"Pan, Jacob jun" <jacob.jun.pan@...el.com>
Subject: Re: [PATCH 3/3] x86,pci,acpi: Handle invalid _CRS

On 04/21/2010 04:43 PM, Yinghai wrote:
>
> then use -v3 please
> 
> -v4: also don't trim [0xa0000, 0x100000] for mrst.
> 

That makes a lot of sense for 2.6.34.  I agree with moving the trimming
into subsystems, but I think it's .35 material at this point.

[Cc: Jacob Pan]

>>
>> The use of a string match in:
>>
>> +       if (check_child && !conflict->child && strstr(conflict->name,
>> "PCI Bus"))
>> ^^^^^^^^^
>>
>> ... screams "wrong! ugly! bad!" in my opinion.  I utterly fail to see
>> how that could be acceptable under any circumstances.  I thought that
>> had been flagged earlier in the conversation, but it is apparently still
>> there.
> 
> the string checking is to make sure pci device that is hooked into bus0 directly, but pci bar is falling into
> 0xa0000 - 0x100000.  So can not put "reserved" holder under them.
> 

It makes me extremely concerned, because such hacks tend to be extremely
vulnerable.  Strings are designed primarily for human consumption, and
"find string inside another string" is *very* much so.  As such, I
really would like to understand that there isn't any more sensible way,
such as a flag, that can be used to accomplish the objective.

	-hpa
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/