linux-kernel - [PATCHv3 0/2] PCI: Safe VPD access

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date:	Thu, 17 Dec 2015 08:59:27 +0100
From:	Hannes Reinecke <hare@...e.de>
To:	Bjorn Helgaas <bhelgaas@...gle.com>
Cc:	Alexander Duyck <alexander.duyck@...il.com>,
	Michal Kubecek <mkubecek@...e.com>,
	"Shane M. Seymour" <shane.seymour@....com>,
	linux-pci@...r.kernel.org, linux-kernel@...r.kernel.org,
	Hannes Reinecke <hare@...e.de>
Subject: [PATCHv3 0/2] PCI: Safe VPD access

PCI VPD suffers from two problems: it has a very rudimentary interface
and it relies on correctly formatted data. And essentially it provides
a direct channel into the card hardware. In other words, plenty of
chances to mess things up.
With the original implementation we would just read the VPD space,
blissfully ignorant of the data formatting of the VPD data. This
would work if the VPD space happens to be properly implemented.
However, I've had several reports where a simple 'cat' on the vpd
attribute would return garbage (if you're lucky), trigger a timeout
with a kernel warning (which actually triggered this patchset), or
hang your machine (if you're really unlucky).
So this patchset validates the VPD data, setting the VPD attribute to
the correct size or disabling VPD access altogether if no valid data
is found.

Hannes Reinecke (2):
  pci: Update VPD definitions
  pci: Update VPD size with correct length

 drivers/pci/access.c | 57 ++++++++++++++++++++++++++++++++++++++++++++++++++++
 include/linux/pci.h  | 27 +++++++++++++++++++++++--
 2 files changed, 82 insertions(+), 2 deletions(-)

-- 
1.8.5.6

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/