linux-kernel - Re: [PATCH] firmware: arm_scmi: quirk: fix write to string constant

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <aLIX-XAYE--byaue@pluto>
Date: Fri, 29 Aug 2025 22:13:29 +0100
From: Cristian Marussi <cristian.marussi@....com>
To: Johan Hovold <johan@...nel.org>
Cc: Sudeep Holla <sudeep.holla@....com>,
	Cristian Marussi <cristian.marussi@....com>,
	arm-scmi@...r.kernel.org, linux-arm-kernel@...ts.infradead.org,
	linux-kernel@...r.kernel.org, stable@...r.kernel.org
Subject: Re: [PATCH] firmware: arm_scmi: quirk: fix write to string constant

On Fri, Aug 29, 2025 at 03:21:52PM +0200, Johan Hovold wrote:
> The quirk version range is typically a string constant and must not be
> modified (e.g. as it may be stored in read-only memory):
> 
> 	Unable to handle kernel write to read-only memory at virtual
> 	address ffffc036d998a947
> 
> Fix the range parsing so that it operates on a copy of the version range
> string, and mark all the quirk strings as const to reduce the risk of
> introducing similar future issues.

Hi,

indeed when implementing this I was a bit doubtful about the in-place
overwrite approach that I used during the ranges parsing...but since
each quirk was indeed initialized once and its range parsed once, it
seemed fair to use the string itself as a sort of scratch area while
parsing it into integers and avoid the local copy...just I haven't
considered the possibility that such strings could be stored in a RO
segment...and I got no error on my setup....

Anyway, good catch, it is certainly better to operate on a copy.

LGTM.

Reviewed-by: Cristian Marussi <cristian.marussi@....com>

Thanks,
Cristian