linux-kernel - Re: [PATCH] dell-wmi: Stop storing pointers to DMI tables

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20160115142719.36eea015@endymion.delvare>
Date:	Fri, 15 Jan 2016 14:27:19 +0100
From:	Jean Delvare <jdelvare@...e.de>
To:	Andy Lutomirski <luto@...capital.net>
Cc:	Pali Rohár <pali.rohar@...il.com>,
	Jean Delvare <jdelvare@...e.com>,
	Andy Lutomirski <luto@...nel.org>,
	platform-driver-x86@...r.kernel.org, linux-kernel@...r.kernel.org,
	stable <stable@...r.kernel.org>
Subject: Re: [PATCH] dell-wmi: Stop storing pointers to DMI tables

Hi Andy,

Sorry for the late reply.

On Wed, 13 Jan 2016 14:28:18 -0800, Andy Lutomirski wrote:
> [cc: Jean Delvare]
> 
> On Tue, Jan 12, 2016 at 6:25 AM, Pali Rohár <pali.rohar@...il.com> wrote:
> > On Monday 11 January 2016 13:58:20 Andy Lutomirski wrote:
> >> On Sun, Jan 3, 2016 at 6:52 AM, Andy Lutomirski <luto@...nel.org> wrote:
> >> > The dmi_walk function maps the DMI table, walks it, and unmaps it.
> >> > This means that the dell_bios_hotkey_table that find_hk_type stores
> >> > points to unmapped memory by the time it gets read.
> >> >
> >> > I've been able to trigger crashes caused by the stale pointer a
> >> > couple of times, but never on a stock kernel.
> >> >
> >> > Fix it by generating the keymap in the dmi_walk callback instead of
> >> > storing a pointer.
> >>
> >> Quick ping: has anyone had a chance to look at this?
> >
> > Hi Andy, I looked at this patch, but I think some people from -mm or DMI
> > code should look at it as it is memory problem... We also has one in
> > dell-laptop.ko (wrong API usage) and so -mm people could know it better.
> 
> Let's ask:
> 
> Jean, am I right that drivers must not store pointers to DMI tables
> that they find through dmi_walk?

Yes, you are right.

> Is there any alternative interface
> that could be used to get a longer-lived pointer to DMI tables, or
> should drivers just parse them and copy out any info needed from the
> dmi_walk callback?

There is no alternative for OEM type records. Drivers are indeed
expected to copy the information they need to their own buffers.

> There are at least two platform drivers (dell-wmi and dell-laptop)
> that don't play well with the current interface.  This patch is
> intended to fix one of them.

Couldn't see any problem with dell-laptop.

-- 
Jean Delvare
SUSE L3 Support