linux-kernel - Re: [PATCH] acpi/nfit: Fix bus command validation

Open Source and information security mailing list archives

Date:   Tue, 19 Feb 2019 20:56:24 -0500
From:   Jeff Moyer <jmoyer@...hat.com>
To:     Dan Williams <dan.j.williams@...el.com>
Cc:     linux-nvdimm@...ts.01.org, Vishal Verma <vishal.verma@...el.com>,
        stable@...r.kernel.org, linux-kernel@...r.kernel.org
Subject: Re: [PATCH] acpi/nfit: Fix bus command validation

Dan Williams <dan.j.williams@...el.com> writes:

> Commit 11189c1089da "acpi/nfit: Fix command-supported detection" broke
> ND_CMD_CALL for bus-level commands. The "func = cmd" assumption is only
> valid for:
>
>     ND_CMD_ARS_CAP
>     ND_CMD_ARS_START
>     ND_CMD_ARS_STATUS
>     ND_CMD_CLEAR_ERROR
>
> The function number otherwise needs to be pulled from the command
> payload for:
>
>     NFIT_CMD_TRANSLATE_SPA
>     NFIT_CMD_ARS_INJECT_SET
>     NFIT_CMD_ARS_INJECT_CLEAR
>     NFIT_CMD_ARS_INJECT_GET
>
> Update cmd_to_func() for the bus case and call it in the common path.
>
> Fixes: 11189c1089da ("acpi/nfit: Fix command-supported detection")
> Cc: <stable@...r.kernel.org>
> Cc: Vishal Verma <vishal.verma@...el.com>
> Reported-by: Grzegorz Burzynski <grzegorz.burzynski@...el.com>
> Signed-off-by: Dan Williams <dan.j.williams@...el.com>

Tricky code path, eh?

Tested-by: Jeff Moyer <jmoyer@...hat.com>

-Jeff

> ---
>  drivers/acpi/nfit/core.c |   22 ++++++++++++----------
>  1 file changed, 12 insertions(+), 10 deletions(-)
>
> diff --git a/drivers/acpi/nfit/core.c b/drivers/acpi/nfit/core.c
> index e18ade5d74e9..c34c595d6bb0 100644
> --- a/drivers/acpi/nfit/core.c
> +++ b/drivers/acpi/nfit/core.c
> @@ -415,7 +415,7 @@ static int cmd_to_func(struct nfit_mem *nfit_mem, unsigned int cmd,
>  	if (call_pkg) {
>  		int i;
>  
> -		if (nfit_mem->family != call_pkg->nd_family)
> +		if (nfit_mem && nfit_mem->family != call_pkg->nd_family)
>  			return -ENOTTY;
>  
>  		for (i = 0; i < ARRAY_SIZE(call_pkg->nd_reserved2); i++)
> @@ -424,6 +424,10 @@ static int cmd_to_func(struct nfit_mem *nfit_mem, unsigned int cmd,
>  		return call_pkg->nd_command;
>  	}
>  
> +	/* In the !call_pkg case, bus commands == bus functions */
> +	if (!nfit_mem)
> +		return cmd;
> +
>  	/* Linux ND commands == NVDIMM_FAMILY_INTEL function numbers */
>  	if (nfit_mem->family == NVDIMM_FAMILY_INTEL)
>  		return cmd;
> @@ -454,17 +458,18 @@ int acpi_nfit_ctl(struct nvdimm_bus_descriptor *nd_desc, struct nvdimm *nvdimm,
>  	if (cmd_rc)
>  		*cmd_rc = -EINVAL;
>  
> +	if (cmd == ND_CMD_CALL)
> +		call_pkg = buf;
> +	func = cmd_to_func(nfit_mem, cmd, call_pkg);
> +	if (func < 0)
> +		return func;
> +
>  	if (nvdimm) {
>  		struct acpi_device *adev = nfit_mem->adev;
>  
>  		if (!adev)
>  			return -ENOTTY;
>  
> -		if (cmd == ND_CMD_CALL)
> -			call_pkg = buf;
> -		func = cmd_to_func(nfit_mem, cmd, call_pkg);
> -		if (func < 0)
> -			return func;
>  		dimm_name = nvdimm_name(nvdimm);
>  		cmd_name = nvdimm_cmd_name(cmd);
>  		cmd_mask = nvdimm_cmd_mask(nvdimm);
> @@ -475,12 +480,9 @@ int acpi_nfit_ctl(struct nvdimm_bus_descriptor *nd_desc, struct nvdimm *nvdimm,
>  	} else {
>  		struct acpi_device *adev = to_acpi_dev(acpi_desc);
>  
> -		func = cmd;
>  		cmd_name = nvdimm_bus_cmd_name(cmd);
>  		cmd_mask = nd_desc->cmd_mask;
> -		dsm_mask = cmd_mask;
> -		if (cmd == ND_CMD_CALL)
> -			dsm_mask = nd_desc->bus_dsm_mask;
> +		dsm_mask = nd_desc->bus_dsm_mask;
>  		desc = nd_cmd_bus_desc(cmd);
>  		guid = to_nfit_uuid(NFIT_DEV_BUS);
>  		handle = adev->handle;
>
> _______________________________________________
> Linux-nvdimm mailing list
> Linux-nvdimm@...ts.01.org
> https://lists.01.org/mailman/listinfo/linux-nvdimm

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives