linux-kernel - Re: [PATCH] EDAC, MCE, AMD: Fix code to prevent NULL dereference

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Mon, 17 Feb 2014 16:36:24 -0600
From:	Aravind Gopalakrishnan <aravind.gopalakrishnan@....com>
To:	Borislav Petkov <bp@...en8.de>
CC:	<dougthompson@...ssion.com>, <linux-edac@...r.kernel.org>,
	<linux-kernel@...r.kernel.org>
Subject: Re: [PATCH] EDAC, MCE, AMD: Fix code to prevent NULL dereference

On 2/17/2014 1:41 PM, Borislav Petkov wrote:
> On Mon, Feb 17, 2014 at 01:26:20PM -0600, Aravind Gopalakrishnan wrote:
>>>   	if (c->x86_vendor != X86_VENDOR_AMD)
>>> -		return 0;
>>> +		return -ENODEV;
>>>   	if (c->x86 < 0xf || c->x86 > 0x16)
>>> -		return 0;
>>> +		return -ENODEV;
>>
> But we still need a fix, I guess the one I sent you does the job, yes,
> no?

Actually, the changes you sent above does the job only if 'edac-mce-amd' 
is configured as module.
If it is built-in (and looks like this is what Kconfig recommends as 
well..), then -
   * We can still modprobe mce_amd_inj
   * inject error
   * mce_amd_inj calls into amd_decode_mce and
   * this for mc0, mc1 and mc2 will lead to NULL dereference if family 
is unsupported.

So we'd still need the patch I sent earlier.
I guess what we really need is a mash-up of both changes..

> If not, I'd need more background info though - you're loading this on an
> unsupported family, right?
Yes. (more or less :) )
(background info to make things clear-)
someone did try this on unsupported HW and got kernel oops.
But since I can't get my hands on one,  I am simulating it by using a 
fam15, M30h box and setting the init condition as
      if (c->x86 < 0xf || c->x86 > 0x14)

snapshot of the oops from simulating on my system:
[   28.846200] [Hardware Error]: MC0 Error:
[   28.846218] BUG: unable to handle kernel NULL pointer dereference 
at           (null)
[   28.846232] IP: [<ffffffff81608526>] amd_decode_mce+0x526/0x900
[   28.846247] PGD 40bc9e067 PUD 40c677067 PMD 0
[   28.846257] Oops: 0000 [#1] SMP
[   28.846264] Modules linked in: mce_amd_inj amd64_edac_mod r8169

here's a sample mc0 error injected after applying both sets of changes 
to the code:
[   94.109090] [Hardware Error]: MC0 Error:
[   94.109103] fam_ops structure not alloc-ed. Cannot provide detailed 
family/model specific error decoding.
[   94.109119] [Hardware Error]: Error Status: Uncorrected, software 
containable error.
[   94.109132] [Hardware Error]: CPU:0 (15:30:0) 
MC0_STATUS[-|UE|-|-|-|-|-]: 0xa000000000010f0f
[   94.109146] [Hardware Error]: cache level: L3/GEN, mem/io: GEN, 
mem-tx: GEN, part-proc: GEN (timed out)

Shall I work up the patch with both sets of changes and resend?

Thanks,
-Aravind.

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/