linux-kernel - Re: memcpy_fromio in dmi

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:	Mon, 08 Jul 2013 15:54:38 +0200
From:	Jean Delvare <jdelvare@...e.de>
To:	Andrew Morton <akpm@...ux-foundation.org>
Cc:	Robin Holt <holt@....com>, "Luck, Tony" <tony.luck@...el.com>,
	DuanZhenzhong <zhenzhong.duan@...cle.com>,
	linux-kernel <linux-kernel@...r.kernel.org>,
	"Yu, Fenghua" <fenghua.yu@...el.com>
Subject: Re: memcpy_fromio in dmi_scan.c

Hi Andrew,

Sorry for the late reply.

Le Thursday 25 April 2013 à 13:37 -0700, Andrew Morton a écrit :
> So what's the fix?  This?
> 
> --- a/drivers/firmware/dmi_scan.c~a
> +++ a/drivers/firmware/dmi_scan.c
> @@ -500,9 +500,12 @@ void __init dmi_scan_machine(void)
>  			goto error;
>  
>  		for (q = p; q < p + 0x10000; q += 16) {
> -			if (memcmp(q, "_SM_", 4) == 0 && q - p <= 0xFFE0)
> +			char buf[5];
> +
> +			memcpy_from_io(buf, q, 5);
> +			if (memcmp(buf, "_SM_", 4) == 0 && q - p <= 0xFFE0)
>  				rc = smbios_present(q);
> -			else if (memcmp(q, "_DMI_", 5) == 0)
> +			else if (memcmp(buf, "_DMI_", 5) == 0)
>  				rc = dmi_present(q);
>  			else
>  				continue;

That would have been it, yes, but meanwhile Ben Hutchings reworked the
whole thing and that fixed the problem I reported as a side effect:

https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/drivers/firmware/dmi_scan.c?id=79bae42d51a5d498500c890c19ef76df41d2bf59

I'd suggest leaving the stable kernels alone until someone complains, as
there doesn't seem to be any issue in practice (the only machines where
it would possibly matter are already hopelessly broken.)

All I can say is that these dmi_scan patches should never have made it
to stable kernels in the first place, as they infringed several rules
stable patches are supposed to comply with.

-- 
Jean Delvare
Suse L3

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/