linux-kernel - [PATCH 3/3] x86/intel_rdt: Return error for incorrect resource names in schemata

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Wed, 19 Apr 2017 16:50:04 -0700
From:   Vikas Shivappa <vikas.shivappa@...ux.intel.com>
To:     vikas.shivappa@...el.com, x86@...nel.org,
        linux-kernel@...r.kernel.org
Cc:     sai.praneeth.prakhya@...el.com, hpa@...or.com, tglx@...utronix.de,
        mingo@...nel.org, ravi.v.shankar@...el.com, tony.luck@...el.com,
        fenghua.yu@...el.com, vikas.shivappa@...ux.intel.com
Subject: [PATCH 3/3] x86/intel_rdt: Return error for incorrect resource names in schemata

When schemata parses the resource names, currently it may not return
error for incorrect resource names and fail quietly without updating the
control values.

This is because for_each_enabled_rdt_resource(r) leaves "r" pointing
beyond the end of the rdt_resources_all[] array, and we check for
!r->name which results in an out of bounds access and also may not be
NULL, hence we may not detect that we did not find the name user
supplied.

Update this to check (r == (rdt_resources_all + RDT_NUM_RESOURCES))
instead.

Reported-by: Prakhya, Sai Praneeth <sai.praneeth.prakhya@...el.com>
Signed-off-by: Vikas Shivappa <vikas.shivappa@...ux.intel.com>
Tested-by: Prakhya, Sai Praneeth <sai.praneeth.prakhya@...el.com>
---
 arch/x86/kernel/cpu/intel_rdt_schemata.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/arch/x86/kernel/cpu/intel_rdt_schemata.c b/arch/x86/kernel/cpu/intel_rdt_schemata.c
index 3cfa1ca..bb99bd8 100644
--- a/arch/x86/kernel/cpu/intel_rdt_schemata.c
+++ b/arch/x86/kernel/cpu/intel_rdt_schemata.c
@@ -228,7 +228,7 @@ ssize_t rdtgroup_schemata_write(struct kernfs_open_file *of,
 				break;
 			}
 		}
-		if (!r->name) {
+		if (r == (rdt_resources_all + RDT_NUM_RESOURCES)) {
 			ret = -EINVAL;
 			goto out;
 		}
-- 
1.9.1