linux-kernel - [PATCH v2] EDAC/ghes: Fix buffer overflow in ghes_edac

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-Id: <20220721180503.896050-1-toshi.kani@hpe.com>
Date:   Thu, 21 Jul 2022 12:05:03 -0600
From:   Toshi Kani <toshi.kani@....com>
To:     bp@...en8.de, rrichter@...vell.com, mchehab@...nel.org
Cc:     toshi.kani@....com, elliott@....com, linux-edac@...r.kernel.org,
        linux-kernel@...r.kernel.org, Borislav Petkov <bp@...e.de>
Subject: [PATCH v2] EDAC/ghes: Fix buffer overflow in ghes_edac_register()

The following buffer overflow BUG was observed on an HPE system.
ghes_edac_register() called strlen() on an uninitialized label,
which had non-zero values from krealloc_array().

In dimm_setup_label(), *device was set but *bank was null, which
left the label uninitialized. *bank is set from SMBIOS type 17
Bank Locator, offset 11h.  This system had this value set to 0x0
(null string).

Change dimm_setup_label() to always initialize the label and use
"NA" in case bank or device is null.

 detected buffer overflow in __fortify_strlen
 ------------[ cut here ]------------
 kernel BUG at lib/string_helpers.c:983!
 invalid opcode: 0000 [#1] PREEMPT SMP NOPTI
 CPU: 1 PID: 1 Comm: swapper/0 Tainted: G          I       5.18.6-200.fc36.x86_64 #1
 Hardware name: HPE ProLiant DL360 Gen10/ProLiant DL360 Gen10, BIOS U32 03/15/2019
 RIP: 0010:fortify_panic+0xf/0x11
 ...
 Call Trace:
  <TASK>
  ghes_edac_register.cold+0x128/0x128
  ghes_probe+0x142/0x3a0
  platform_probe+0x41/0x90
  really_probe+0x19e/0x370
  __driver_probe_device+0xfc/0x170
  driver_probe_device+0x1f/0x90
  __driver_attach+0xbb/0x190
  ? __device_attach_driver+0xe0/0xe0
  bus_for_each_dev+0x5f/0x90
  bus_add_driver+0x159/0x200
  driver_register+0x89/0xd0
  acpi_ghes_init+0x72/0xc3
  acpi_init+0x441/0x493
  ? acpi_sleep_proc_init+0x24/0x24
  do_one_initcall+0x41/0x200

Fixes: b9cae27728d1f ("EDAC/ghes: Scan the system once on driver init")
Tested-by: Robert Elliott <elliott@....com>
Signed-off-by: Toshi Kani <toshi.kani@....com>
Cc: Robert Richter <rrichter@...vell.com>
Cc: Borislav Petkov <bp@...e.de>
Cc: Mauro Carvalho Chehab <mchehab@...nel.org>
---
 drivers/edac/ghes_edac.c |    7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/drivers/edac/ghes_edac.c b/drivers/edac/ghes_edac.c
index 59b0bedc9c24..8256065b1801 100644
--- a/drivers/edac/ghes_edac.c
+++ b/drivers/edac/ghes_edac.c
@@ -100,12 +100,13 @@ static struct dimm_info *find_dimm_by_handle(struct mem_ctl_info *mci, u16 handl
 static void dimm_setup_label(struct dimm_info *dimm, u16 handle)
 {
 	const char *bank = NULL, *device = NULL;
+	const char *na = "NA";
 
 	dmi_memdev_name(handle, &bank, &device);
 
-	/* both strings must be non-zero */
-	if (bank && *bank && device && *device)
-		snprintf(dimm->label, sizeof(dimm->label), "%s %s", bank, device);
+	snprintf(dimm->label, sizeof(dimm->label), "%s %s",
+			(bank && *bank) ? bank : na,
+			(device && *device) ? device : na);
 }
 
 static void assign_dmi_dimm_info(struct dimm_info *dimm, struct memdev_dmi_entry *entry)