linux-kernel - Re: [PATCH v2] PCI: rcar-ep: Fix the issue of the name parameter when calling devm_request_mem

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <tencent_92781245E66AD47A12F3B907548289877308@qq.com>
Date: Tue,  7 Jan 2025 08:59:06 +0800
From: kingdix10@...com
To: manivannan.sadhasivam@...aro.org
Cc: bhelgaas@...gle.com,
	kingdix10@...com,
	kw@...ux.com,
	linux-kernel@...r.kernel.org,
	linux-pci@...r.kernel.org,
	linux-renesas-soc@...r.kernel.org,
	lpieralisi@...nel.org,
	marek.vasut+renesas@...il.com,
	robh@...nel.org,
	s.shtylyov@....ru,
	yoshihiro.shimoda.uh@...esas.com
Subject: Re: [PATCH v2] PCI: rcar-ep: Fix the issue of the name parameter when calling devm_request_mem_region

On Sun, 2025-01-05 at 22:23 +0530, Manivannan Sadhasivam wrote:
> On Sun, Jan 05, 2025 at 01:57:51PM +0800, kingdix10@...com wrote:
> > From: King Dix <kingdix10@...com>
> > 
> > When using devm_request_mem_region to request a resource, if the
> > passed
> > variable is a stack string variable, it will lead to an oops issue
> > when
> > eecuting the command cat /proc/iomem.
> > 
> 
> Is this your observation or you saw the oops? If the latter, please
> include
> the relevant log snippet for reference.
> 
> > Fix this by replacing outbound_name with the name of the previously
> > requested resource.
> > 
> > Signed-off-by: King Dix <kingdix10@...com>
> 
> Also, please do not send next version as a reply to the previous one.
> 
> Reviewed-by: Manivannan Sadhasivam <manivannan.sadhasivam@...aro.org>
> 
> - Mani
> 
> > ---
> > Changes in v2:
> >   - Fix the code indentation issue.
> > ---
> >  drivers/pci/controller/pcie-rcar-ep.c | 2 +-
> >  1 file changed, 1 insertion(+), 1 deletion(-)
> > 
> > diff --git a/drivers/pci/controller/pcie-rcar-ep.c
> > b/drivers/pci/controller/pcie-rcar-ep.c
> > index 047e2cef5afc..c5e0d025bc43 100644
> > --- a/drivers/pci/controller/pcie-rcar-ep.c
> > +++ b/drivers/pci/controller/pcie-rcar-ep.c
> > @@ -107,7 +107,7 @@ static int
> > rcar_pcie_parse_outbound_ranges(struct rcar_pcie_endpoint *ep,
> >  		}
> >  		if (!devm_request_mem_region(&pdev->dev, res->start,
> >  					     resource_size(res),
> > -					     outbound_name)) {
> > +					     res->name)) {
> >  			dev_err(pcie->dev, "Cannot request memory region %s.\n",
> >  				outbound_name);
> >  			return -EIO;
> > -- 
> > 2.43.0
> > 
> 

This is only a potential issue that I found while analyzing the code.
When cat /proc/iomem is executed, the r_show function called, it will 
access the name parameter of resource. Specifically, if a variable on
the stack is used when calling devm_request_mem_region, it will lead to
an oops problem.