linux-kernel - Re: [PATCH] RFC: platform/x86: wmi: Fix check for method instance number

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20170614203906.GE22450@fury>
Date:   Wed, 14 Jun 2017 13:39:06 -0700
From:   Darren Hart <dvhart@...radead.org>
To:     Pali Rohár <pali.rohar@...il.com>
Cc:     Andy Shevchenko <andy@...radead.org>,
        Andy Lutomirski <luto@...nel.org>,
        platform-driver-x86@...r.kernel.org, linux-kernel@...r.kernel.org
Subject: Re: [PATCH] RFC: platform/x86: wmi: Fix check for method instance
 number

On Wed, Jun 14, 2017 at 05:46:54PM +0200, Pali Rohár wrote:
> On Tuesday 13 June 2017 11:42:28 Darren Hart wrote:
> > On Tue, Jun 13, 2017 at 08:04:57PM +0200, Pali Rohár wrote:
> > > On Tuesday 13 June 2017 18:49:51 Darren Hart wrote:
> > > > I'd suggest reaching out to the maintainers and contributors to the
> > > > drivers you mention to request some help in testing.
> > > 
> > > Seems sane. Grep for all methods with instance number different as zero 
> > > (or just number one -- which can be suspicious as somebody could thought 
> > > that indexing is from one, not zer) and try to receive ACPI/BMOF data 
> > > and verify it.
> > 
> > This would still be the ideal solution, verify we can do the right thing
> > without breaking existing drivers. Agreed.
> 
> Here is all usage:
> 

Thanks for pulling this together Pali.

...

> So problematic drivers which use instance=1 without any comments are:
> 
>   acer-wmi
>   alienware-wmi
>   asus-wmi
>   dell-wmi-led
>   mxm-wmi
> 

I'd suggest adding a WARN_ONCE() when instance >= instance_count (I guess only
== concerns us) as a way to draw out any problematic usage. We can let that go
while we try to collect data from the other driver maintainers and see if it
generates any more hits.

-- 
Darren Hart
VMware Open Source Technology Center