linux-kernel - Re: [PATCH] platform/x86: intel_pmc_core: fix out-of-bounds accesses on stack

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <CAHp75VcZ1zVag78zujsuA1mZNMMSsxsTb9Efs3WO0D0c+K9Hcw@mail.gmail.com>
Date:   Sat, 28 Jan 2017 16:12:46 +0200
From:   Andy Shevchenko <andy.shevchenko@...il.com>
To:     Andrey Ryabinin <aryabinin@...tuozzo.com>
Cc:     Rajneesh Bhardwaj <rajneesh.bhardwaj@...el.com>,
        Vishwanath Somayaji <vishwanath.somayaji@...el.com>,
        Darren Hart <dvhart@...radead.org>,
        Andy Shevchenko <andy@...radead.org>,
        Platform Driver <platform-driver-x86@...r.kernel.org>,
        "linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>
Subject: Re: [PATCH] platform/x86: intel_pmc_core: fix out-of-bounds accesses
 on stack

On Fri, Jan 27, 2017 at 6:31 PM, Andrey Ryabinin
<aryabinin@...tuozzo.com> wrote:
> On 01/27/2017 06:42 PM, Andy Shevchenko wrote:
>> On Thu, Jan 26, 2017 at 4:27 PM, Andrey Ryabinin
>> <aryabinin@...tuozzo.com> wrote:
>>>  #if IS_ENABLED(CONFIG_DEBUG_FS)
>>> @@ -234,12 +230,8 @@ static const struct file_operations pmc_core_ppfear_ops = {
>>>  /* This function should return link status, 0 means ready */
>>>  static int pmc_core_mtpmc_link_status(void)
>>>  {
>>> -       struct pmc_dev *pmcdev = &pmc;
>>> -       u32 value;
>>> -
>>> -       value = pmc_core_reg_read(pmcdev, SPT_PMC_PM_STS_OFFSET);
>>> -       return test_bit(SPT_PMC_MSG_FULL_STS_BIT,
>>> -                       (unsigned long *)&value);
>>> +       u32 value = pmc_core_reg_read(&pmc, SPT_PMC_PM_STS_OFFSET);
>>> +       return value & (1U << SPT_PMC_MSG_FULL_STS_BIT);
>>>  }
>>
>> Thanks for the patch. IIRC I told (or may be forgot to tell) them
>> during internal review about the nasty casting.
>>
>> Btw, have you checked this will work in the same way, since test_bit()
>> is atomic?
>
> 'value' is a local variable, atomicity is pointless here.

Ah, indeed.

>> And if it's okay, why not to use BIT() macro?

> It just a matter of taste. I find open-coded variant easier to read.

Okay, what I'm about to do:

- switch to BIT() macro (it's already used by the driver)
- revert unrelated changes (piece of code where we get value)

and push it to testing.

Tell me if you have any objections.

-- 
With Best Regards,
Andy Shevchenko