linux-kernel - [PATCH v3 0/3] mcb-pci: fix memory overlapping on MCB devices

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <20230330104949.21918-1-josejavier.rodriguez@duagon.com>
Date:   Thu, 30 Mar 2023 10:50:01 +0000
From:   Rodríguez Barbarin, José Javier 
        <JoseJavier.Rodriguez@...gon.com>
To:     "morbidrsa@...il.com" <morbidrsa@...il.com>,
        "linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>
CC:     "jth@...nel.org" <jth@...nel.org>,
        Sanjuán García, Jorge 
        <Jorge.SanjuanGarcia@...gon.com>,
        Rodríguez Barbarin, José Javier 
        <JoseJavier.Rodriguez@...gon.com>
Subject: [PATCH v3 0/3] mcb-pci: fix memory overlapping on MCB devices

mcb-pci driver is allocating the memory region for the "chameleon table"
with a fixed size of 0x200. This region is only use to do a initial
parsing to discover the devices implemented as IP Cores.

If the "chameleon table" is actually smalled than 0x200 and the first
device offset happen to be within 0x200, a memory overlapping can ocurr.

Here an extract of the memory overlapping when registering a 16z125 IP Core:

[   31.016972] 8250_men_mcb mcb0-16z125-0:0:0: can't request region for resource [mem 0xa8200100-0xa820010f]
[   31.016994] 8250_men_mcb: probe of mcb0-16z125-0:0:0 failed with error -16
[   31.017010] 8250_men_mcb mcb0-16z125-1:0:0: can't request region for resource [mem 0xa8200110-0xa820011f]

And here, the memory allocated for the chameleon table parsing:

user@...t:$ sudo /proc/iomem
...
a8200000-a82001ff : mcb_pci
...

This patch solves this problem by dropping/reallocating the memory region of the
"chamelon table" with the actual size once it has been parsed.

This patch is based on linux-next (next-20230323)

Changes for V3:
 * handle return value if no chameleon cells found.
 * remove stray newline.
 * reword typo in PATCH 1 commit message.

Changes for V2:
 * make parsing function return the size of "chameleon table".
 * reallocate instead of not requesting the memory region.

Javier Rodriguez (3):
  mcb: Return actual parsed size when reading chameleon table
  mcb-pci: Reallocate memory region to avoid memory overlapping
  mcb-lpc: Reallocate memory region to avoid memory overlapping

 drivers/mcb/mcb-lpc.c   | 35 +++++++++++++++++++++++++++++++----
 drivers/mcb/mcb-parse.c | 15 ++++++++++-----
 drivers/mcb/mcb-pci.c   | 27 +++++++++++++++++++++++++--
 3 files changed, 66 insertions(+), 11 deletions(-)

-- 
2.34.1