linux-kernel - Re: [PATCH] ACPI/PPTT: fix off-by-one error

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <CAJZ5v0gTRcivKKVOx8YhrPyfXJBwL0x+zay9wXrWeod4Lf_Kwg@mail.gmail.com>
Date: Wed, 7 May 2025 13:59:12 +0200
From: "Rafael J. Wysocki" <rafael@...nel.org>
To: "Heyne, Maximilian" <mheyne@...zon.de>
Cc: Jeremy Linton <jeremy.linton@....com>, Sudeep Holla <sudeep.holla@....com>, 
	"stable@...r.kernel.org" <stable@...r.kernel.org>, "Rafael J. Wysocki" <rafael@...nel.org>, Len Brown <lenb@...nel.org>, 
	Ard Biesheuvel <ardb@...nel.org>, Catalin Marinas <catalin.marinas@....com>, 
	"linux-acpi@...r.kernel.org" <linux-acpi@...r.kernel.org>, 
	"linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>
Subject: Re: [PATCH] ACPI/PPTT: fix off-by-one error

On Wed, May 7, 2025 at 1:53 PM Heyne, Maximilian <mheyne@...zon.de> wrote:
>
> On Tue, May 06, 2025 at 03:11:20PM -0500, Jeremy Linton wrote:
> > Hi,
> >
> > On 5/6/25 8:43 AM, Sudeep Holla wrote:
> > > On Tue, May 06, 2025 at 01:13:02PM +0000, Heyne, Maximilian wrote:
> > > > Commit 7ab4f0e37a0f ("ACPI PPTT: Fix coding mistakes in a couple of
> > > > sizeof() calls") corrects the processer entry size but unmasked a longer
> > > > standing bug where the last entry in the structure can get skipped due
> > > > to an off-by-one mistake if the last entry ends exactly at the end of
> > > > the ACPI subtable.
> > > >
> > >
> > > Unless the firmware has populated an incorrect value for the header length, I
> > > don't see how this is possible. The table_end should point to the address
> > > immediately following the last byte of the table. None of the headers are only
> > > one byte long, so what am I missing that could explain this apparent
> > > off-by-one issue?.
> >
> > More likely its because the sizeof() fix was merged without proper review
> > and is wrong because the type isn't actually known on the object until the
> > header is checked.
>
> I agree that the type might not be known at this point but the condition
>
>         proc_sz = sizeof(struct acpi_pptt_processor);
>           while((unsigned long)entry + proc_sz <= table_end)
>
> would make sure that there could potentially be a node of type
> acpi_pptt_processor because there is at least space for it. If the entry
> can't be of that size because it would go over table_end then it can't
> be an acpi_pptt_processor.

I don't follow.

If it is an acpi_pptt_processor entry, the original condition would be
sufficient (assuming the correctness of the table header), wouldn't
it?

> Therefore, I don't think the sizeof() fix is that wrong but we just need
> to adjust the while condition.

The sizeof() fix is correct, it makes the code work as designed.

> Alternatively, we could at least make sure that we can safely access
> (without crossing table_end) the acpi_subtable_header to check the type.

Yes.

> But the current approach seems cleaner to me.

Why do you think so?