linux-kernel - [PATCH kernel v7 16/20] powerpc/powernv/npu: Check mmio

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Thu, 20 Dec 2018 19:23:46 +1100
From:   Alexey Kardashevskiy <aik@...abs.ru>
To:     linuxppc-dev@...ts.ozlabs.org
Cc:     Alexey Kardashevskiy <aik@...abs.ru>,
        David Gibson <david@...son.dropbear.id.au>,
        kvm-ppc@...r.kernel.org, kvm@...r.kernel.org,
        Alistair Popple <alistair@...ple.id.au>,
        Reza Arbab <arbab@...ux.ibm.com>,
        Sam Bobroff <sbobroff@...ux.ibm.com>,
        Piotr Jaroszynski <pjaroszynski@...dia.com>,
        Leonardo Augusto Guimarães Garcia 
        <lagarcia@...ibm.com>, Jose Ricardo Ziviani <joserz@...ux.ibm.com>,
        Daniel Henrique Barboza <danielhb413@...il.com>,
        Alex Williamson <alex.williamson@...hat.com>,
        Paul Mackerras <paulus@...abs.org>,
        linux-kernel@...r.kernel.org, Christoph Hellwig <hch@...radead.org>
Subject: [PATCH kernel v7 16/20] powerpc/powernv/npu: Check mmio_atsd array bounds when populating

A broken device tree might contain more than 8 values and introduce hard
to debug memory corruption bug. This adds the boundary check.

Signed-off-by: Alexey Kardashevskiy <aik@...abs.ru>
---
 arch/powerpc/platforms/powernv/npu-dma.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/arch/powerpc/platforms/powernv/npu-dma.c b/arch/powerpc/platforms/powernv/npu-dma.c
index e06043b..c6163b9 100644
--- a/arch/powerpc/platforms/powernv/npu-dma.c
+++ b/arch/powerpc/platforms/powernv/npu-dma.c
@@ -1179,8 +1179,9 @@ int pnv_npu2_init(struct pci_controller *hose)
 
 	npu->nmmu_flush = of_property_read_bool(hose->dn, "ibm,nmmu-flush");
 
-	for (i = 0; !of_property_read_u64_index(hose->dn, "ibm,mmio-atsd",
-							i, &mmio_atsd); i++)
+	for (i = 0; i < ARRAY_SIZE(npu->mmio_atsd_regs) &&
+			!of_property_read_u64_index(hose->dn, "ibm,mmio-atsd",
+				i, &mmio_atsd); i++)
 		npu->mmio_atsd_regs[i] = ioremap(mmio_atsd, 32);
 
 	pr_info("NPU%d: Found %d MMIO ATSD registers", hose->global_number, i);
-- 
2.17.1