linux-kernel - Re: [PATCH v2 1/2] x86/mce/AMD: Define function to get SMCA bank type

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Sun, 10 Dec 2017 15:47:47 +0100
From:   Borislav Petkov <bp@...e.de>
To:     Yazen Ghannam <Yazen.Ghannam@....com>
Cc:     linux-edac@...r.kernel.org, Tony Luck <tony.luck@...el.com>,
        x86@...nel.org, linux-kernel@...r.kernel.org
Subject: Re: [PATCH v2 1/2] x86/mce/AMD: Define function to get SMCA bank type

On Thu, Dec 07, 2017 at 02:39:54PM -0600, Yazen Ghannam wrote:
> diff --git a/arch/x86/kernel/cpu/mcheck/mce_amd.c b/arch/x86/kernel/cpu/mcheck/mce_amd.c
> index a38ab1fa53a2..219d5115f4d4 100644
> --- a/arch/x86/kernel/cpu/mcheck/mce_amd.c
> +++ b/arch/x86/kernel/cpu/mcheck/mce_amd.c
> @@ -110,6 +110,16 @@ const char *smca_get_long_name(enum smca_bank_types t)
>  }
>  EXPORT_SYMBOL_GPL(smca_get_long_name);
>  
> +static enum smca_bank_types smca_get_bank_type(struct mce *m)
> +{
> +	struct smca_bank bank = smca_banks[m->bank];
					   ^^^^^^^^

That's a NULL ptr deref waiting to happen.

Also, struct smca_bank bank should be a pointer.

I ended up committing this:

---
From: Yazen Ghannam <yazen.ghannam@....com>
Date: Thu, 7 Dec 2017 14:39:54 -0600
Subject: [PATCH] x86/MCE/AMD: Define a function to get SMCA bank type

Scalable MCA systems have various types of banks. The bank's type
can determine how we handle errors from it. For example, if a bank
represents a UMC (Unified Memory Controller) then we will need to
convert its address from a normalized address to a system physical
address before handling the error.

Signed-off-by: Yazen Ghannam <yazen.ghannam@....com>
Cc: Tony Luck <tony.luck@...el.com>
Cc: linux-edac <linux-edac@...r.kernel.org>
Cc: x86-ml <x86@...nel.org>
Link: http://lkml.kernel.org/r/20171207203955.118171-1-Yazen.Ghannam@amd.com
[ Verify m->bank is within range and use bank pointer. ]
Signed-off-by:
---
 arch/x86/kernel/cpu/mcheck/mce_amd.c | 14 ++++++++++++++
 1 file changed, 14 insertions(+)

diff --git a/arch/x86/kernel/cpu/mcheck/mce_amd.c b/arch/x86/kernel/cpu/mcheck/mce_amd.c
index a38ab1fa53a2..661c4738be27 100644
--- a/arch/x86/kernel/cpu/mcheck/mce_amd.c
+++ b/arch/x86/kernel/cpu/mcheck/mce_amd.c
@@ -110,6 +110,20 @@ const char *smca_get_long_name(enum smca_bank_types t)
 }
 EXPORT_SYMBOL_GPL(smca_get_long_name);
 
+static enum smca_bank_types smca_get_bank_type(struct mce *m)
+{
+	struct smca_bank *b;
+
+	if (m->bank >= N_SMCA_BANK_TYPES)
+		return N_SMCA_BANK_TYPES;
+
+	b = &smca_banks[m->bank];
+	if (!b->hwid)
+		return N_SMCA_BANK_TYPES;
+
+	return b->hwid->bank_type;
+}
+
 static struct smca_hwid smca_hwid_mcatypes[] = {
 	/* { bank_type, hwid_mcatype, xec_bitmap } */
 
-- 
2.13.0

SUSE Linux GmbH, GF: Felix Imendörffer, Jane Smithard, Graham Norton, HRB 21284 (AG Nürnberg)
--