linux-kernel - Re: [PATCH v6] acpi: nfit: vmalloc-out-of-bounds Read in acpi_nfit

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <674ddfa6abc4d_3cb8e0294cf@iweiny-mobl.notmuch>
Date: Mon, 2 Dec 2024 10:26:14 -0600
From: Ira Weiny <ira.weiny@...el.com>
To: Suraj Sonawane <surajsonawane0215@...il.com>, <dan.j.williams@...el.com>
CC: <vishal.l.verma@...el.com>, <dave.jiang@...el.com>, <ira.weiny@...el.com>,
	<rafael@...nel.org>, <lenb@...nel.org>, <nvdimm@...ts.linux.dev>,
	<linux-acpi@...r.kernel.org>, <linux-kernel@...r.kernel.org>,
	<syzbot+7534f060ebda6b8b51b3@...kaller.appspotmail.com>
Subject: Re: [PATCH v6] acpi: nfit: vmalloc-out-of-bounds Read in
 acpi_nfit_ctl

Suraj Sonawane wrote:
> On 11/18/24 21:56, Suraj Sonawane wrote:

[snip]

> > 
> >   drivers/acpi/nfit/core.c | 7 ++++++-
> >   1 file changed, 6 insertions(+), 1 deletion(-)
> > 
> > diff --git a/drivers/acpi/nfit/core.c b/drivers/acpi/nfit/core.c
> > index 5429ec9ef..a5d47819b 100644
> > --- a/drivers/acpi/nfit/core.c
> > +++ b/drivers/acpi/nfit/core.c
> > @@ -454,8 +454,13 @@ int acpi_nfit_ctl(struct nvdimm_bus_descriptor *nd_desc, struct nvdimm *nvdimm,
> >   	if (cmd_rc)
> >   		*cmd_rc = -EINVAL;
> >   
> > -	if (cmd == ND_CMD_CALL)
> > +	if (cmd == ND_CMD_CALL) {
> > +		if (!buf || buf_len < sizeof(*call_pkg))
> > +			return -EINVAL;
> > +
> >   		call_pkg = buf;
> > +	}
> > +
> >   	func = cmd_to_func(nfit_mem, cmd, call_pkg, &family);
> >   	if (func < 0)
> >   		return func;
> 
> Hello!
> 
> I wanted to follow up on the patch I submitted. I have incorporated all 
> the suggested changes up to v6. I was wondering if you had a chance to 
> review it and if there are any comments or feedback.

It just missed the soak period for the merge.  But I'll be looking at it
for an rc pull request.

Thanks for sticking with it,
Ira

[snip]