linux-kernel - Re: [PATCH] resource: make sure requested range intersects root range

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Tue, 10 Jul 2012 14:33:48 -0700
From:	Andrew Morton <akpm@...ux-foundation.org>
To:	Octavian Purdila <octavian.purdila@...el.com>
Cc:	"H. Peter Anvin" <hpa@...or.com>, linux-kernel@...r.kernel.org,
	Ram Pai <linuxram@...ibm.com>,
	Jesse Barnes <jbarnes@...tuousgeek.org>
Subject: Re: [PATCH] resource: make sure requested range intersects root
 range

On Sat, 30 Jun 2012 15:00:57 +0300
Octavian Purdila <octavian.purdila@...el.com> wrote:

> When the requested and root ranges do not intersect the logic in
> __reserve_region_with_split will cause an infinite recursion which
> will overflow the stack as seen in the warning bellow.
> 
> This particular stack overflow was caused by requesting the
> (100000000-107ffffff) range while the root range was (0-ffffffff). In
> this case __request_resource would return the whole root range as
> conflict range (i.e. 0-ffffffff). Then, the logic in
> __reserve_region_with_split would continue the recursion requesting
> the new range as (conflict->end+1, end) which incidentally in this
> case equals the originally requested range.
> 
> This patch aborts looking for a usable range when the requested one is
> completely outside the root range to avoid the infinite recursion, and
> since this indicates a problem in the layers above, it also prints an
> error message indicating the requested and root range in order to make
> the problem more easily traceable.

I think we should also emit a stack trace so the faulty caller can be
pinpointed.

> ...
>
> --- a/kernel/resource.c
> +++ b/kernel/resource.c
> @@ -789,7 +789,13 @@ void __init reserve_region_with_split(struct resource *root,
>  		const char *name)
>  {
>  	write_lock(&resource_lock);
> -	__reserve_region_with_split(root, start, end, name);
> +	if (start > root->end || end < root->start)
> +		pr_err("Requested range (0x%llx-0x%llx) not in root range (0x%llx-0x%llx)\n",
> +		       (unsigned long long)start, (unsigned long long)end,
> +		       (unsigned long long)root->start,
> +		       (unsigned long long)root->end);
> +	else
> +		__reserve_region_with_split(root, start, end, name);
>  	write_unlock(&resource_lock);
>  }

The fancy way of doing that is

	if (!WARN(start > root->end || end < root->start),
		  "Requested range (0x%llx-0x%llx) not in root range (0x%llx-0x%llx)\n",
		       (unsigned long long)start, (unsigned long long)end,
		       (unsigned long long)root->start,
		       (unsigned long long)root->end)
		__reserve_region_with_split(root, start, end, name);

but that's quite the eyesore.  How about doing it the simple way?

--- a/kernel/resource.c~resource-make-sure-requested-range-intersects-root-range-fix
+++ a/kernel/resource.c
@@ -792,13 +792,15 @@ void __init reserve_region_with_split(st
 		const char *name)
 {
 	write_lock(&resource_lock);
-	if (start > root->end || end < root->start)
+	if (start > root->end || end < root->start) {
 		pr_err("Requested range (0x%llx-0x%llx) not in root range (0x%llx-0x%llx)\n",
 		       (unsigned long long)start, (unsigned long long)end,
 		       (unsigned long long)root->start,
 		       (unsigned long long)root->end);
-	else
+		dump_stack();
+	} else {
 		__reserve_region_with_split(root, start, end, name);
+	}
 	write_unlock(&resource_lock);
 }
 
_

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/