| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <CAJZ5v0jeeYAtUEoc8C2TkA+dG8hR0S090RNNfs1DfzSkbxFoTg@mail.gmail.com>
Date: Wed, 20 Sep 2023 19:22:30 +0200
From: "Rafael J. Wysocki" <rafael@...nel.org>
To: shiju.jose@...wei.com
Cc: helgaas@...nel.org, rafael@...nel.org, lenb@...nel.org,
tony.luck@...el.com, james.morse@....com, bp@...en8.de,
ying.huang@...el.com, linux-acpi@...r.kernel.org,
linux-pci@...r.kernel.org, linux-kernel@...r.kernel.org,
linuxarm@...wei.com, jonathan.cameron@...wei.com,
tanxiaofei@...wei.com, prime.zeng@...ilicon.com
Subject: Re: [PATCH v2 1/1] ACPI / APEI: Fix for overwriting AER info when
error status data has multiple sections
On Tue, Sep 19, 2023 at 11:16 AM <shiju.jose@...wei.com> wrote:
>
> From: Shiju Jose <shiju.jose@...wei.com>
>
> ghes_handle_aer() passes AER data to the PCI core for logging and
> recovery by calling aer_recover_queue() with a pointer to struct
> aer_capability_regs.
>
> The problem was that aer_recover_queue() queues the pointer directly
> without copying the aer_capability_regs data. The pointer was to
> the ghes->estatus buffer, which could be reused before
> aer_recover_work_func() reads the data.
>
> To avoid this problem, allocate a new aer_capability_regs structure
> from the ghes_estatus_pool, copy the AER data from the ghes->estatus
> buffer into it, pass a pointer to the new struct to
> aer_recover_queue(), and free it after aer_recover_work_func() has
> processed it.
>
> Reported-by: Bjorn Helgaas <helgaas@...nel.org>
> Acked-by: Bjorn Helgaas <bhelgaas@...gle.com>
> Signed-off-by: Shiju Jose <shiju.jose@...wei.com>
> ---
> Changes from v1 to v2:
> 1. Updated patch description with the description Bjorn has suggested.
> 2. Add Acked-by: Bjorn Helgaas <bhelgaas@...gle.com>.
> ---
> drivers/acpi/apei/ghes.c | 23 ++++++++++++++++++++++-
> drivers/pci/pcie/aer.c | 10 ++++++++++
> include/acpi/ghes.h | 1 +
> 3 files changed, 33 insertions(+), 1 deletion(-)
>
> diff --git a/drivers/acpi/apei/ghes.c b/drivers/acpi/apei/ghes.c
> index ef59d6ea16da..63ad0541db38 100644
> --- a/drivers/acpi/apei/ghes.c
> +++ b/drivers/acpi/apei/ghes.c
> @@ -209,6 +209,20 @@ int ghes_estatus_pool_init(unsigned int num_ghes)
> return -ENOMEM;
> }
>
> +/**
> + * ghes_estatus_pool_region_free - free previously allocated memory
> + * from the ghes_estatus_pool.
> + * @addr: address of memory to free.
> + * @size: size of memory to free.
> + *
> + * Returns none.
> + */
> +void ghes_estatus_pool_region_free(unsigned long addr, u32 size)
> +{
> + gen_pool_free(ghes_estatus_pool, addr, size);
> +}
> +EXPORT_SYMBOL_GPL(ghes_estatus_pool_region_free);
> +
> static int map_gen_v2(struct ghes *ghes)
> {
> return apei_map_generic_address(&ghes->generic_v2->read_ack_register);
> @@ -564,6 +578,7 @@ static void ghes_handle_aer(struct acpi_hest_generic_data *gdata)
> pcie_err->validation_bits & CPER_PCIE_VALID_AER_INFO) {
> unsigned int devfn;
> int aer_severity;
> + u8 *aer_info;
>
> devfn = PCI_DEVFN(pcie_err->device_id.device,
> pcie_err->device_id.function);
> @@ -577,11 +592,17 @@ static void ghes_handle_aer(struct acpi_hest_generic_data *gdata)
> if (gdata->flags & CPER_SEC_RESET)
> aer_severity = AER_FATAL;
>
> + aer_info = (void *)gen_pool_alloc(ghes_estatus_pool,
> + sizeof(struct aer_capability_regs));
> + if (!aer_info)
> + return;
> + memcpy(aer_info, pcie_err->aer_info, sizeof(struct aer_capability_regs));
> +
> aer_recover_queue(pcie_err->device_id.segment,
> pcie_err->device_id.bus,
> devfn, aer_severity,
> (struct aer_capability_regs *)
> - pcie_err->aer_info);
> + aer_info);
> }
> #endif
> }
> diff --git a/drivers/pci/pcie/aer.c b/drivers/pci/pcie/aer.c
> index e85ff946e8c8..388b614c11fd 100644
> --- a/drivers/pci/pcie/aer.c
> +++ b/drivers/pci/pcie/aer.c
> @@ -29,6 +29,7 @@
> #include <linux/kfifo.h>
> #include <linux/slab.h>
> #include <acpi/apei.h>
> +#include <acpi/ghes.h>
> #include <ras/ras_event.h>
>
> #include "../pci.h"
> @@ -996,6 +997,15 @@ static void aer_recover_work_func(struct work_struct *work)
> continue;
> }
> cper_print_aer(pdev, entry.severity, entry.regs);
> + /*
> + * Memory for aer_capability_regs(entry.regs) is being allocated from the
> + * ghes_estatus_pool to protect it from overwriting when multiple sections
> + * are present in the error status. Thus free the same after processing
> + * the data.
> + */
> + ghes_estatus_pool_region_free((unsigned long)entry.regs,
> + sizeof(struct aer_capability_regs));
> +
> if (entry.severity == AER_NONFATAL)
> pcie_do_recovery(pdev, pci_channel_io_normal,
> aer_root_reset);
> diff --git a/include/acpi/ghes.h b/include/acpi/ghes.h
> index 3c8bba9f1114..40d89e161076 100644
> --- a/include/acpi/ghes.h
> +++ b/include/acpi/ghes.h
> @@ -78,6 +78,7 @@ static inline struct list_head *ghes_get_devices(void) { return NULL; }
> #endif
>
> int ghes_estatus_pool_init(unsigned int num_ghes);
> +void ghes_estatus_pool_region_free(unsigned long addr, u32 size);
If I'm not mistaken, this needs to go under #ifdef
CONFIG_ACPI_APEI_GHES and it needs an empty stub for the case when
CONFIG_ACPI_APEI_GHES is not set.
>
> static inline int acpi_hest_get_version(struct acpi_hest_generic_data *gdata)
> {
> --
> 2.34.1
>
Powered by blists - more mailing lists