linux-kernel - Re: [PATCH] cxl/cdat: Free correct buffer on checksum error

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <ZVfIaNhiSc-yQZo5@rric.localdomain>
Date:   Fri, 17 Nov 2023 21:09:12 +0100
From:   Robert Richter <rrichter@....com>
To:     Ira Weiny <ira.weiny@...el.com>
Cc:     Davidlohr Bueso <dave@...olabs.net>,
        Jonathan Cameron <jonathan.cameron@...wei.com>,
        Dave Jiang <dave.jiang@...el.com>,
        Alison Schofield <alison.schofield@...el.com>,
        Vishal Verma <vishal.l.verma@...el.com>,
        Dan Williams <dan.j.williams@...el.com>,
        linux-cxl@...r.kernel.org, linux-kernel@...r.kernel.org,
        Fan Ni <nifan.cxl@...il.com>
Subject: Re: [PATCH] cxl/cdat: Free correct buffer on checksum error

On 16.11.23 16:03:29, Ira Weiny wrote:
> The new 6.7-rc1 kernel now checks the checksum on CDAT data.  While
> using a branch of Fan's DCD qemu work (and specifying DCD devices), the
> following splat was observed.
> 
> 	WARNING: CPU: 1 PID: 1384 at drivers/base/devres.c:1064 devm_kfree+0x4f/0x60
> 	...
> 	RIP: 0010:devm_kfree+0x4f/0x60
> 	...
>  	? devm_kfree+0x4f/0x60
>  	read_cdat_data+0x1a0/0x2a0 [cxl_core]
>  	cxl_port_probe+0xdf/0x200 [cxl_port]
> 	...
> 
> The issue in qemu is still unknown but the spat is a straight forward
> bug in the CDAT checksum processing code.  Use a CDAT buffer variable to
> ensure the devm_free() works correctly on error.
> 
> Cc: jonathan.cameron@...wei.com
> Cc: Fan Ni <nifan.cxl@...il.com>
> Fixes: 670e4e88f3b1 ("cxl: Add checksum verification to CDAT from CXL")
> Cc: Dave Jiang <dave.jiang@...el.com>
> Signed-off-by: Ira Weiny <ira.weiny@...el.com>

Reviewed-by: Robert Richter <rrichter@....com>

I will send an on-top patch for 6.8 that reworks that code area to
remove the pointer arithmetic.

-Robert