linux-kernel - [tip:x86/urgent] acpi/nfit, x86/mce: Validate a MCE's address before using it

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <tip-e8a308e5f47e545e0d41d0686c00f5f5217c5f61@git.kernel.org>
Date:   Tue, 6 Nov 2018 10:19:25 -0800
From:   tip-bot for Vishal Verma <tipbot@...or.com>
To:     linux-tip-commits@...r.kernel.org
Cc:     yazen.ghannam@....com, bp@...e.de, dan.j.williams@...el.com,
        mingo@...nel.org, tony.luck@...el.com, mingo@...hat.com,
        x86@...nel.org, arnd@...db.de, qiuxu.zhuo@...el.com,
        rjw@...ysocki.net, elliott@....com, linux-edac@...r.kernel.org,
        tglx@...utronix.de, lenb@...nel.org, stable@...r.kernel.org,
        vishal.l.verma@...el.com, hpa@...or.com,
        linux-kernel@...r.kernel.org, zwisler@...nel.org,
        dave.jiang@...el.com
Subject: [tip:x86/urgent] acpi/nfit, x86/mce: Validate a MCE's address
 before using it

Commit-ID:  e8a308e5f47e545e0d41d0686c00f5f5217c5f61
Gitweb:     https://git.kernel.org/tip/e8a308e5f47e545e0d41d0686c00f5f5217c5f61
Author:     Vishal Verma <vishal.l.verma@...el.com>
AuthorDate: Thu, 25 Oct 2018 18:37:29 -0600
Committer:  Borislav Petkov <bp@...e.de>
CommitDate: Tue, 6 Nov 2018 19:13:26 +0100

acpi/nfit, x86/mce: Validate a MCE's address before using it

The NFIT machine check handler uses the physical address from the mce
structure, and compares it against information in the ACPI NFIT table
to determine whether that location lies on an NVDIMM. The mce->addr
field however may not always be valid, and this is indicated by the
MCI_STATUS_ADDRV bit in the status field.

Export mce_usable_address() which already performs validation for the
address, and use it in the NFIT handler.

Fixes: 6839a6d96f4e ("nfit: do an ARS scrub on hitting a latent media error")
Reported-by: Robert Elliott <elliott@....com>
Signed-off-by: Vishal Verma <vishal.l.verma@...el.com>
Signed-off-by: Borislav Petkov <bp@...e.de>
CC: Arnd Bergmann <arnd@...db.de>
Cc: Dan Williams <dan.j.williams@...el.com>
CC: Dave Jiang <dave.jiang@...el.com>
CC: elliott@....com
CC: "H. Peter Anvin" <hpa@...or.com>
CC: Ingo Molnar <mingo@...hat.com>
CC: Len Brown <lenb@...nel.org>
CC: linux-acpi@...r.kernel.org
CC: linux-edac <linux-edac@...r.kernel.org>
CC: linux-nvdimm@...ts.01.org
CC: Qiuxu Zhuo <qiuxu.zhuo@...el.com>
CC: "Rafael J. Wysocki" <rjw@...ysocki.net>
CC: Ross Zwisler <zwisler@...nel.org>
CC: stable <stable@...r.kernel.org>
CC: Thomas Gleixner <tglx@...utronix.de>
CC: Tony Luck <tony.luck@...el.com>
CC: x86-ml <x86@...nel.org>
CC: Yazen Ghannam <yazen.ghannam@....com>
Link: http://lkml.kernel.org/r/20181026003729.8420-2-vishal.l.verma@intel.com
---
 arch/x86/include/asm/mce.h       | 1 +
 arch/x86/kernel/cpu/mcheck/mce.c | 3 ++-
 drivers/acpi/nfit/mce.c          | 4 ++++
 3 files changed, 7 insertions(+), 1 deletion(-)

diff --git a/arch/x86/include/asm/mce.h b/arch/x86/include/asm/mce.h
index dbd9fe2f6163..c1a812bd5a27 100644
--- a/arch/x86/include/asm/mce.h
+++ b/arch/x86/include/asm/mce.h
@@ -222,6 +222,7 @@ static inline void mce_hygon_feature_init(struct cpuinfo_x86 *c) { return mce_am
 int mce_available(struct cpuinfo_x86 *c);
 bool mce_is_memory_error(struct mce *m);
 bool mce_is_correctable(struct mce *m);
+int mce_usable_address(struct mce *m);
 
 DECLARE_PER_CPU(unsigned, mce_exception_count);
 DECLARE_PER_CPU(unsigned, mce_poll_count);
diff --git a/arch/x86/kernel/cpu/mcheck/mce.c b/arch/x86/kernel/cpu/mcheck/mce.c
index 77527b8ea982..36d2696c9563 100644
--- a/arch/x86/kernel/cpu/mcheck/mce.c
+++ b/arch/x86/kernel/cpu/mcheck/mce.c
@@ -485,7 +485,7 @@ static void mce_report_event(struct pt_regs *regs)
  * be somewhat complicated (e.g. segment offset would require an instruction
  * parser). So only support physical addresses up to page granuality for now.
  */
-static int mce_usable_address(struct mce *m)
+int mce_usable_address(struct mce *m)
 {
 	if (!(m->status & MCI_STATUS_ADDRV))
 		return 0;
@@ -505,6 +505,7 @@ static int mce_usable_address(struct mce *m)
 
 	return 1;
 }
+EXPORT_SYMBOL_GPL(mce_usable_address);
 
 bool mce_is_memory_error(struct mce *m)
 {
diff --git a/drivers/acpi/nfit/mce.c b/drivers/acpi/nfit/mce.c
index 7a51707f87e9..d6c1b10f6c25 100644
--- a/drivers/acpi/nfit/mce.c
+++ b/drivers/acpi/nfit/mce.c
@@ -29,6 +29,10 @@ static int nfit_handle_mce(struct notifier_block *nb, unsigned long val,
 	if (!mce_is_memory_error(mce) || mce_is_correctable(mce))
 		return NOTIFY_DONE;
 
+	/* Verify the address reported in the MCE is valid. */
+	if (!mce_usable_address(mce))
+		return NOTIFY_DONE;
+
 	/*
 	 * mce->addr contains the physical addr accessed that caused the
 	 * machine check. We need to walk through the list of NFITs, and see