linux-kernel - RE: [PATCH] stm class: Fix out of bound access from bitmap allocation

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <fe3a301b03b84761a08d5b15962b8110@AcuMS.aculab.com>
Date:   Fri, 5 Apr 2019 13:14:00 +0000
From:   David Laight <David.Laight@...LAB.COM>
To:     'Sai Prakash Ranjan' <saiprakash.ranjan@...eaurora.org>,
        "Alexander Shishkin" <alexander.shishkin@...ux.intel.com>,
        Greg Kroah-Hartman <gregkh@...uxfoundation.org>,
        Mulu He <muluhe@...eaurora.org>,
        Tingwei Zhang <tingwei@...eaurora.org>,
        Maxime Coquelin <mcoquelin.stm32@...il.com>,
        Alexandre Torgue <alexandre.torgue@...com>,
        "linux-stm32@...md-mailman.stormreply.com" 
        <linux-stm32@...md-mailman.stormreply.com>,
        Mathieu Poirier <mathieu.poirier@...aro.org>,
        Suzuki K Poulose <suzuki.poulose@....com>,
        "Mike Leach" <mike.leach@...aro.org>, Leo Yan <leo.yan@...aro.org>
CC:     Rajendra Nayak <rnayak@...eaurora.org>,
        Vivek Gautam <vivek.gautam@...eaurora.org>,
        Sibi Sankar <sibis@...eaurora.org>,
        "linux-arm-kernel@...ts.infradead.org" 
        <linux-arm-kernel@...ts.infradead.org>,
        "linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>,
        "linux-arm-msm@...r.kernel.org" <linux-arm-msm@...r.kernel.org>,
        "stable@...r.kernel.org" <stable@...r.kernel.org>
Subject: RE: [PATCH] stm class: Fix out of bound access from bitmap allocation

From: Sai Prakash Ranjan
> Sent: 05 April 2019 13:23
> 
> From: Mulu He <muluhe@...eaurora.org>
> 
> Bitmap allocation works on array of unsigned longs and
> for stm master allocation when the number of software
> channels is 32, 4 bytes are allocated and there is a out of
> bound access at the first 8 bytes access of bitmap region.
> 
> Fixes: 7bd1d4093c2f ("stm class: Introduce an abstraction for System Trace Module devices")
> Signed-off-by: Mulu He <muluhe@...eaurora.org>
> Signed-off-by: Sai Prakash Ranjan <saiprakash.ranjan@...eaurora.org>
> Cc: stable@...r.kernel.org
> ---
>  drivers/hwtracing/stm/core.c | 2 +-
>  drivers/hwtracing/stm/stm.h  | 2 ++
>  2 files changed, 3 insertions(+), 1 deletion(-)
> 
> diff --git a/drivers/hwtracing/stm/core.c b/drivers/hwtracing/stm/core.c
> index 93ce3aa740a9..21a5838f6e67 100644
> --- a/drivers/hwtracing/stm/core.c
> +++ b/drivers/hwtracing/stm/core.c
> @@ -168,7 +168,7 @@ static int stp_master_alloc(struct stm_device *stm, unsigned int idx)
>  	struct stp_master *master;
>  	size_t size;
> 
> -	size = ALIGN(stm->data->sw_nchannels, 8) / 8;
> +	size = ALIGN(stm->data->sw_nchannels, STM_MASTER_SZ) / STM_MASTER_SZ;

I'm not sure that using STP_MASTER_SZ improves readability at all.

Is there something that gives the size of a bitmap for 'n' items?

	David

-
Registered Address Lakeside, Bramley Road, Mount Farm, Milton Keynes, MK1 1PT, UK
Registration No: 1397386 (Wales)