linux-kernel - Re: [External] [PATCH] platform/x86: think-lmi: Abort probe on analyze failure

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <ec4bfa3d-ddd7-9826-f3eb-16878c0bdb8e@lenovo.com>
Date:   Mon, 8 Nov 2021 13:24:40 -0500
From:   Mark Pearson <markpearson@...ovo.com>
To:     Alex Williamson <alex.williamson@...hat.com>,
        <hdegoede@...hat.com>, <markgross@...nel.org>
CC:     <platform-driver-x86@...r.kernel.org>,
        <linux-kernel@...r.kernel.org>
Subject: Re: [External] [PATCH] platform/x86: think-lmi: Abort probe on
 analyze failure


Thanks Alex

On 2021-11-08 13:03, Alex Williamson wrote:
> A Lenovo ThinkStation S20 (4157CTO BIOS 60KT41AUS) fails to boot on
> recent kernels including the think-lmi driver, due to the fact that
> errors returned by the tlmi_analyze() function are ignored by
> tlmi_probe(), where  tlmi_sysfs_init() is called unconditionally.
> This results in making use of an array of already freed, non-null
> pointers and other uninitialized globals, causing all sorts of nasty
> kobject and memory faults.
> 
> Make use of the analyze function return value, free a couple leaked
> allocations, and remove the settings_count field, which is incremented
> but never consumed.
> 
> Fixes: a40cd7ef22fb ("platform/x86: think-lmi: Add WMI interface support on Lenovo platforms")
> Signed-off-by: Alex Williamson <alex.williamson@...hat.com>
> ---
>   drivers/platform/x86/think-lmi.c |   13 ++++++++++---
>   drivers/platform/x86/think-lmi.h |    1 -
>   2 files changed, 10 insertions(+), 4 deletions(-)
> 
> diff --git a/drivers/platform/x86/think-lmi.c b/drivers/platform/x86/think-lmi.c
> index 9472aae72df2..c4d9c45350f7 100644
> --- a/drivers/platform/x86/think-lmi.c
> +++ b/drivers/platform/x86/think-lmi.c
> @@ -888,8 +888,10 @@ static int tlmi_analyze(void)
>   			break;
>   		if (!item)
>   			break;
> -		if (!*item)
> +		if (!*item) {
> +			kfree(item);
>   			continue;
> +		}
I feel bad that I missed this in my original commit.
I've (obviously) not seen it on any platforms I've tested. I'll see if
we can get the FW team to address the origins of this too - I'm guessing
the root cause is in the FW

>   
>   		/* It is not allowed to have '/' for file name. Convert it into '\'. */
>   		strreplace(item, '/', '\\');
> @@ -902,6 +904,7 @@ static int tlmi_analyze(void)
>   		setting = kzalloc(sizeof(*setting), GFP_KERNEL);
>   		if (!setting) {
>   			ret = -ENOMEM;
> +			kfree(item);
>   			goto fail_clear_attr;
>   		}
>   		setting->index = i;
> @@ -916,7 +919,6 @@ static int tlmi_analyze(void)
>   		}
>   		kobject_init(&setting->kobj, &tlmi_attr_setting_ktype);
>   		tlmi_priv.setting[i] = setting;
> -		tlmi_priv.settings_count++;
>   		kfree(item);
>   	}
>   
> @@ -983,7 +985,12 @@ static void tlmi_remove(struct wmi_device *wdev)
>   
>   static int tlmi_probe(struct wmi_device *wdev, const void *context)
>   {
> -	tlmi_analyze();
> +	int ret;
> +
> +	ret = tlmi_analyze();
> +	if (ret)
> +		return ret;
> +
>   	return tlmi_sysfs_init();
>   }
Looks good

>   
> diff --git a/drivers/platform/x86/think-lmi.h b/drivers/platform/x86/think-lmi.h
> index f8e26823075f..2ce5086a5af2 100644
> --- a/drivers/platform/x86/think-lmi.h
> +++ b/drivers/platform/x86/think-lmi.h
> @@ -55,7 +55,6 @@ struct tlmi_attr_setting {
>   struct think_lmi {
>   	struct wmi_device *wmi_device;
>   
> -	int settings_count;
>   	bool can_set_bios_settings;
>   	bool can_get_bios_selections;
>   	bool can_set_bios_password;
> 
Originally the settings_count was used in the ioctl based driver we 
have, but I have no issue with it being removed as it serves no use. 
Thanks for the clean up.

Reviewed-by: Mark Pearson <markpearson@...ovo.com>

Mark