linux-kernel - Re: [PATCH 4/4] platform/x86: Add Intel Software Defined Silicon driver

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <4d8ba355de09a4a806b6075305ca8d7156dc70ef.camel@linux.intel.com>
Date:   Sun, 21 Nov 2021 09:18:25 -0800
From:   "David E. Box" <david.e.box@...ux.intel.com>
To:     Greg KH <gregkh@...uxfoundation.org>
Cc:     lee.jones@...aro.org, hdegoede@...hat.com, bhelgaas@...gle.com,
        andriy.shevchenko@...ux.intel.com, srinivas.pandruvada@...el.com,
        mgross@...ux.intel.com, linux-kernel@...r.kernel.org,
        platform-driver-x86@...r.kernel.org, linux-pci@...r.kernel.org
Subject: Re: [PATCH 4/4] platform/x86: Add Intel Software Defined Silicon
 driver

Hi Greg,

On Sun, 2021-11-21 at 13:31 +0100, Greg KH wrote:
> On Sat, Nov 20, 2021 at 03:17:05PM -0800, David E. Box wrote:
> > +static ssize_t registers_read(struct file *filp, struct kobject *kobj,
> > +			      struct bin_attribute *attr, char *buf, loff_t off,
> > +			      size_t count)
> > +{
> > +	struct device *dev = kobj_to_dev(kobj);
> > +	struct sdsi_priv *priv = dev_get_drvdata(dev);
> > +	void __iomem *addr = priv->regs_addr;
> > +
> > +	memcpy_fromio(buf, addr + off, count);
> 
> Oh nice, this will be fun if I provide "interesting" values for off to
> the function right?
> 
> Remember:
> 	All input is evil.

I was relying on sysfs_kf_bin_read() which checks off (pos) before calling us.

        if (size) {
                if (pos >= size)
                        return 0;
                if (pos + count > size)
                        count = size - pos;
        }

> 
> > +
> > +	return count;
> > +}
> > +static BIN_ATTR(registers, 0400, registers_read, NULL, SDSI_SIZE_REGS);
> > +
> > +static struct bin_attribute *sdsi_bin_attrs[] = {
> > +	&bin_attr_registers,
> > +	&bin_attr_state_certificate,
> > +	&bin_attr_provision_akc,
> > +	&bin_attr_provision_cap,
> > +	NULL
> > +};
> > +
> > +static ssize_t guid_show(struct device *dev, struct device_attribute *attr,
> > char *buf)
> > +{
> > +	struct sdsi_priv *priv = dev_get_drvdata(dev);
> > +
> > +	return sprintf(buf, "0x%x\n", priv->guid);
> 
> sysfs_emit() please.
> 
> These sysfs attributes are crazy.  Who has audited them to be correct
> and work properly? It feels like there are just buffer overflows
> waiting to be exploited in them due to the reading/writing of raw memory
> buffers all over the place.

Agree with the concern. I can submit the tests that were used. Is selftests the
best place?

> 
> Where is the userspace tool that uses these files?

The tool will be published in the same github repo as the spec once the driver
is ready.

Thanks.

David

> 
> thanks,
> 
> greg k-h