linux-kernel - Re: [PATCH 1/1] platform/x86/intel: Fix uninitialized entry in pmt_crashlog

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <CAHp75VenPBtQJ7SVMaOLqER_5HjUDUT-bdJawb3LK=n9oU+4Yg@mail.gmail.com>
Date:   Wed, 8 Jun 2022 12:58:47 +0200
From:   Andy Shevchenko <andy.shevchenko@...il.com>
To:     Xiaohui Zhang <xiaohuizhang@....edu.cn>
Cc:     "David E . Box" <david.e.box@...ux.intel.com>,
        Hans de Goede <hdegoede@...hat.com>,
        Mark Gross <markgross@...nel.org>,
        Platform Driver <platform-driver-x86@...r.kernel.org>,
        Linux Kernel Mailing List <linux-kernel@...r.kernel.org>
Subject: Re: [PATCH 1/1] platform/x86/intel: Fix uninitialized entry in pmt_crashlog_probe

On Wed, Jun 8, 2022 at 9:45 AM Xiaohui Zhang <xiaohuizhang@....edu.cn> wrote:
>
> Similar to the handling of pmt_telem_probe in commit 2cdfa0c20d58
> ("platform/x86/intel: Fix 'rmmod pmt_telemetry' panic"), we thought
> a patch might be needed here as well.
>
> The probe function, pmt_crashlog_probe(), adds an entry for devices even if
> they have not been initialized.  This results in the array of initialized
> devices containing both initialized and uninitialized entries.  This
> causes a panic in the remove function, pmt_crashlog_remove() which expects
> the array to only contain initialized entries.
>
> Only use an entry when a device is initialized.

...

>         auxiliary_set_drvdata(auxdev, priv);
>
>         for (i = 0; i < intel_vsec_dev->num_resources; i++) {
> -               struct intel_pmt_entry *entry = &priv->entry[i].entry;
> +               struct intel_pmt_entry *entry = &priv->entry[priv->num_entries].entry;

This requires more explanation, what do the entry and the i mean in
the below call? Why is using the same entry over all resources fine?
num_entries as an index is pointing out of bounds, is that what was
really expected (first free entry?)?


>                 ret = intel_pmt_dev_create(entry, &pmt_crashlog_ns, intel_vsec_dev, i);
>                 if (ret < 0)


-- 
With Best Regards,
Andy Shevchenko