• Eiichi Tsukata's avatar
    EDAC: Fix global-out-of-bounds write when setting edac_mc_poll_msec · d8655e76
    Eiichi Tsukata authored
    Commit 9da21b15 ("EDAC: Poll timeout cannot be zero, p2") assumes
    edac_mc_poll_msec to be unsigned long, but the type of the variable still
    remained as int. Setting edac_mc_poll_msec can trigger out-of-bounds
    write.
    
    Reproducer:
    
      # echo 1001 > /sys/module/edac_core/parameters/edac_mc_poll_msec
    
    KASAN report:
    
      BUG: KASAN: global-out-of-bounds in edac_set_poll_msec+0x140/0x150
      Write of size 8 at addr ffffffffb91b2d00 by task bash/1996
    
      CPU: 1 PID: 1996 Comm: bash Not tainted 5.2.0-rc6+ #23
      Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-2.fc30 04/01/2014
      Call Trace:
       dump_stack+0xca/0x13e
       print_address_description.cold+0x5/0x246
       __kasan_report.cold+0x75/0x9a
       ? edac_set_poll_msec+0x140/0x150
       kasan_report+0xe/0x20
       edac_set_poll_msec+0x140/0x150
       ? dimmdev_location_show+0x30/0x30
       ? vfs_lock_file+0xe0/0xe0
       ? _raw_spin_lock+0x87/0xe0
       param_attr_store+0x1b5/0x310
       ? param_array_set+0x4f0/0x4f0
       module_attr_store+0x58/0x80
       ? module_attr_show+0x80/0x80
       sysfs_kf_write+0x13d/0x1a0
       kernfs_fop_write+0x2bc/0x460
       ? sysfs_kf_bin_read+0x270/0x270
       ? kernfs_notify+0x1f0/0x1f0
       __vfs_write+0x81/0x100
       vfs_write+0x1e1/0x560
       ksys_write+0x126/0x250
       ? __ia32_sys_read+0xb0/0xb0
       ? do_syscall_64+0x1f/0x390
       do_syscall_64+0xc1/0x390
       entry_SYSCALL_64_after_hwframe+0x49/0xbe
      RIP: 0033:0x7fa7caa5e970
      Code: 73 01 c3 48 8b 0d 28 d5 2b 00 f7 d8 64 89 01 48 83 c8 ff c3 66 0f 1f 44 00 00 83 3d 99 2d 2c 00 00 75 10 b8 01 00 00 00 04
      RSP: 002b:00007fff6acfdfe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
      RAX: ffffffffffffffda RBX: 0000000000000005 RCX: 00007fa7caa5e970
      RDX: 0000000000000005 RSI: 0000000000e95c08 RDI: 0000000000000001
      RBP: 0000000000e95c08 R08: 00007fa7cad1e760 R09: 00007fa7cb36a700
      R10: 0000000000000073 R11: 0000000000000246 R12: 0000000000000005
      R13: 0000000000000001 R14: 00007fa7cad1d600 R15: 0000000000000005
    
      The buggy address belongs to the variable:
       edac_mc_poll_msec+0x0/0x40
    
      Memory state around the buggy address:
       ffffffffb91b2c00: 00 00 00 00 fa fa fa fa 00 00 00 00 fa fa fa fa
       ffffffffb91b2c80: 00 00 00 00 fa fa fa fa 00 00 00 00 fa fa fa fa
      >ffffffffb91b2d00: 04 fa fa fa fa fa fa fa 04 fa fa fa fa fa fa fa
                         ^
       ffffffffb91b2d80: 04 fa fa fa fa fa fa fa 00 00 00 00 00 00 00 00
       ffffffffb91b2e00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
    
    Fix it by changing the type of edac_mc_poll_msec to unsigned int.
    The reason why this patch adopts unsigned int rather than unsigned long
    is msecs_to_jiffies() assumes arg to be unsigned int. We can avoid
    integer conversion bugs and unsigned int will be large enough for
    edac_mc_poll_msec.
    Reviewed-by: default avatarJames Morse <james.morse@arm.com>
    Fixes: 9da21b15 ("EDAC: Poll timeout cannot be zero, p2")
    Signed-off-by: default avatarEiichi Tsukata <devel@etsukata.com>
    Signed-off-by: default avatarTony Luck <tony.luck@intel.com>
    d8655e76
Name
Last commit
Last update
..
Kconfig Loading commit data...
Makefile Loading commit data...
altera_edac.c Loading commit data...
altera_edac.h Loading commit data...
amd64_edac.c Loading commit data...
amd64_edac.h Loading commit data...
amd64_edac_dbg.c Loading commit data...
amd64_edac_inj.c Loading commit data...
amd76x_edac.c Loading commit data...
amd8111_edac.c Loading commit data...
amd8111_edac.h Loading commit data...
amd8131_edac.c Loading commit data...
amd8131_edac.h Loading commit data...
aspeed_edac.c Loading commit data...
cell_edac.c Loading commit data...
cpc925_edac.c Loading commit data...
debugfs.c Loading commit data...
e752x_edac.c Loading commit data...
e7xxx_edac.c Loading commit data...
edac_device.c Loading commit data...
edac_device.h Loading commit data...
edac_device_sysfs.c Loading commit data...
edac_mc.c Loading commit data...
edac_mc.h Loading commit data...
edac_mc_sysfs.c Loading commit data...
edac_module.c Loading commit data...
edac_module.h Loading commit data...
edac_pci.c Loading commit data...
edac_pci.h Loading commit data...
edac_pci_sysfs.c Loading commit data...
fsl_ddr_edac.c Loading commit data...
fsl_ddr_edac.h Loading commit data...
ghes_edac.c Loading commit data...
highbank_l2_edac.c Loading commit data...
highbank_mc_edac.c Loading commit data...
i10nm_base.c Loading commit data...
i3000_edac.c Loading commit data...
i3200_edac.c Loading commit data...
i5000_edac.c Loading commit data...
i5100_edac.c Loading commit data...
i5400_edac.c Loading commit data...
i7300_edac.c Loading commit data...
i7core_edac.c Loading commit data...
i82443bxgx_edac.c Loading commit data...
i82860_edac.c Loading commit data...
i82875p_edac.c Loading commit data...
i82975x_edac.c Loading commit data...
ie31200_edac.c Loading commit data...
layerscape_edac.c Loading commit data...
mce_amd.c Loading commit data...
mce_amd.h Loading commit data...
mpc85xx_edac.c Loading commit data...
mpc85xx_edac.h Loading commit data...
mv64x60_edac.c Loading commit data...
mv64x60_edac.h Loading commit data...
octeon_edac-l2c.c Loading commit data...
octeon_edac-lmc.c Loading commit data...
octeon_edac-pc.c Loading commit data...
octeon_edac-pci.c Loading commit data...
pasemi_edac.c Loading commit data...
pnd2_edac.c Loading commit data...
pnd2_edac.h Loading commit data...
ppc4xx_edac.c Loading commit data...
ppc4xx_edac.h Loading commit data...
qcom_edac.c Loading commit data...
r82600_edac.c Loading commit data...
sb_edac.c Loading commit data...
sifive_edac.c Loading commit data...
skx_base.c Loading commit data...
skx_common.c Loading commit data...
skx_common.h Loading commit data...
synopsys_edac.c Loading commit data...
thunderx_edac.c Loading commit data...
ti_edac.c Loading commit data...
wq.c Loading commit data...
x38_edac.c Loading commit data...
xgene_edac.c Loading commit data...