linux-kernel - Re: [PATCH] of: address: Unify resource bounds overflow checking

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-Id: <20250108140414.13530-1-basharath@couthit.com>
Date: Wed,  8 Jan 2025 19:34:14 +0530
From: Basharath Hussain Khaja <basharath@...thit.com>
To: robh@...nel.org,
	mpe@...erman.id.au,
	thomas.weissschuh@...utronix.de
Cc: devicetree@...r.kernel.org,
	linux-kernel@...r.kernel.org,
	linuxppc-dev@...ts.ozlabs.org,
	saravanak@...gle.com,
	basharath@...thit.com,
	danishanwar@...com,
	krishna@...thit.com,
	mohan@...thit.com,
	parvathi@...thit.com,
	pmohan@...thit.com
Subject: Re: [PATCH] of: address: Unify resource bounds overflow checking

Hi,

>> Thomas Weißschuh <thomas.weissschuh@...utronix.de> writes:
>> > The members "start" and "end" of struct resource are of type
>> > "resource_size_t" which can be 32bit wide.
>> > Values read from OF however are always 64bit wide.
>> >
>> > Refactor the diff overflow checks into a helper function.
>> > Also extend the checks to validate each calculation step.
>> >
>> > Signed-off-by: Thomas Weißschuh <thomas.weissschuh@...utronix.de>
>> > ---
>> >  drivers/of/address.c | 45 ++++++++++++++++++++++++++-------------------
>> >  1 file changed, 26 insertions(+), 19 deletions(-)
>> >
>> > diff --git a/drivers/of/address.c b/drivers/of/address.c
>> > index 7e59283a4472..df854bb427ce 100644
>> > --- a/drivers/of/address.c
>> > +++ b/drivers/of/address.c
>> > @@ -198,6 +198,25 @@ static u64 of_bus_pci_map(__be32 *addr, const __be32 *range, int na, int ns,
>> >
>> >  #endif /* CONFIG_PCI */
>> >
>> > +static int __of_address_resource_bounds(struct resource *r, u64 start, u64 size)
>> > +{
>> > +     u64 end = start;
>> > +
>> > +     if (overflows_type(start, r->start))
>> > +             return -EOVERFLOW;
>> > +     if (size == 0)
>> > +             return -EOVERFLOW;
>> > +     if (check_add_overflow(end, size - 1, &end))
>> > +             return -EOVERFLOW;
>> > +     if (overflows_type(end, r->end))
>> > +             return -EOVERFLOW;
>>
>> This breaks PCI on powerpc qemu. Part of the PCI probe reads a resource
>> that's zero sized, which used to succeed but now fails due to the size
>> check above.
>>
>> The diff below fixes it for me.
>
> I fixed it up with your change.


This commit is breaking Ethernet functionality on the TI AM57xx platform due to zero byte SRAM block size allocation during initialization. Prior to this patch, zero byte block sizes were handled properly.

The issue is with the following line of code:

if (size && check_add_overflow(end, size - 1, &end))  // check_add_overflow not called when size is zero

We feel check_add_overflow() should be invoked even when the size is zero to ensure correct block size allocation.

Thanks & Best Regards,
Basharath