android_kernel_oneplus_msm8998/drivers/edac
Eiichi Tsukata 27ba9eed3d EDAC: Fix global-out-of-bounds write when setting edac_mc_poll_msec
[ Upstream commit d8655e7630dafa88bc37f101640e39c736399771 ]

Commit 9da21b1509 ("EDAC: Poll timeout cannot be zero, p2") assumes
edac_mc_poll_msec to be unsigned long, but the type of the variable still
remained as int. Setting edac_mc_poll_msec can trigger out-of-bounds
write.

Reproducer:

  # echo 1001 > /sys/module/edac_core/parameters/edac_mc_poll_msec

KASAN report:

  BUG: KASAN: global-out-of-bounds in edac_set_poll_msec+0x140/0x150
  Write of size 8 at addr ffffffffb91b2d00 by task bash/1996

  CPU: 1 PID: 1996 Comm: bash Not tainted 5.2.0-rc6+ #23
  Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-2.fc30 04/01/2014
  Call Trace:
   dump_stack+0xca/0x13e
   print_address_description.cold+0x5/0x246
   __kasan_report.cold+0x75/0x9a
   ? edac_set_poll_msec+0x140/0x150
   kasan_report+0xe/0x20
   edac_set_poll_msec+0x140/0x150
   ? dimmdev_location_show+0x30/0x30
   ? vfs_lock_file+0xe0/0xe0
   ? _raw_spin_lock+0x87/0xe0
   param_attr_store+0x1b5/0x310
   ? param_array_set+0x4f0/0x4f0
   module_attr_store+0x58/0x80
   ? module_attr_show+0x80/0x80
   sysfs_kf_write+0x13d/0x1a0
   kernfs_fop_write+0x2bc/0x460
   ? sysfs_kf_bin_read+0x270/0x270
   ? kernfs_notify+0x1f0/0x1f0
   __vfs_write+0x81/0x100
   vfs_write+0x1e1/0x560
   ksys_write+0x126/0x250
   ? __ia32_sys_read+0xb0/0xb0
   ? do_syscall_64+0x1f/0x390
   do_syscall_64+0xc1/0x390
   entry_SYSCALL_64_after_hwframe+0x49/0xbe
  RIP: 0033:0x7fa7caa5e970
  Code: 73 01 c3 48 8b 0d 28 d5 2b 00 f7 d8 64 89 01 48 83 c8 ff c3 66 0f 1f 44 00 00 83 3d 99 2d 2c 00 00 75 10 b8 01 00 00 00 04
  RSP: 002b:00007fff6acfdfe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
  RAX: ffffffffffffffda RBX: 0000000000000005 RCX: 00007fa7caa5e970
  RDX: 0000000000000005 RSI: 0000000000e95c08 RDI: 0000000000000001
  RBP: 0000000000e95c08 R08: 00007fa7cad1e760 R09: 00007fa7cb36a700
  R10: 0000000000000073 R11: 0000000000000246 R12: 0000000000000005
  R13: 0000000000000001 R14: 00007fa7cad1d600 R15: 0000000000000005

  The buggy address belongs to the variable:
   edac_mc_poll_msec+0x0/0x40

  Memory state around the buggy address:
   ffffffffb91b2c00: 00 00 00 00 fa fa fa fa 00 00 00 00 fa fa fa fa
   ffffffffb91b2c80: 00 00 00 00 fa fa fa fa 00 00 00 00 fa fa fa fa
  >ffffffffb91b2d00: 04 fa fa fa fa fa fa fa 04 fa fa fa fa fa fa fa
                     ^
   ffffffffb91b2d80: 04 fa fa fa fa fa fa fa 00 00 00 00 00 00 00 00
   ffffffffb91b2e00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Fix it by changing the type of edac_mc_poll_msec to unsigned int.
The reason why this patch adopts unsigned int rather than unsigned long
is msecs_to_jiffies() assumes arg to be unsigned int. We can avoid
integer conversion bugs and unsigned int will be large enough for
edac_mc_poll_msec.

Reviewed-by: James Morse <james.morse@arm.com>
Fixes: 9da21b1509 ("EDAC: Poll timeout cannot be zero, p2")
Signed-off-by: Eiichi Tsukata <devel@etsukata.com>
Signed-off-by: Tony Luck <tony.luck@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2019-08-04 09:34:48 +02:00
..
altera_edac.c EDAC, altera: Convert to debugfs wrappers 2015-09-22 18:20:56 +02:00
altera_edac.h EDAC, altera: SoCFPGA EDAC should not look for ECC_CORR_EN 2015-10-15 11:57:23 +02:00
amd64_edac.c EDAC, amd64_edac: Shift wrapping issue in f1x_get_norm_dct_addr() 2016-04-12 09:08:36 -07:00
amd64_edac.h EDAC, amd64_edac: Update copyright and remove changelog 2015-09-29 13:41:04 +02:00
amd64_edac_dbg.c EDAC: amd64: Use static attribute groups 2015-02-23 13:08:09 +01:00
amd64_edac_inj.c EDAC: amd64: Use static attribute groups 2015-02-23 13:08:09 +01:00
amd76x_edac.c EDAC: Remove DEFINE_PCI_DEVICE_TABLE macro 2013-12-06 10:23:41 +01:00
amd8111_edac.c amd8111_edac: Fix leaks in probe error paths 2014-02-25 10:09:09 +01:00
amd8111_edac.h
amd8131_edac.c
amd8131_edac.h
cell_edac.c edac: drop owner assignment from platform_drivers 2014-10-20 16:20:30 +02:00
cpc925_edac.c cpc925_edac: Report UE events properly 2014-10-22 22:58:45 +02:00
debugfs.c EDAC: Use edac_debugfs_remove_recursive() 2015-10-14 18:50:32 +02:00
e7xxx_edac.c e7xxx_edac: Report CE events properly 2014-10-22 22:59:00 +02:00
e752x_edac.c e752x_edac: Drop pvt->bridge_ck 2014-02-25 10:01:30 +01:00
edac_core.h EDAC: Carve out debugfs functionality 2015-09-22 12:29:46 +02:00
edac_device.c EDAC: Robustify workqueues destruction 2016-03-03 15:07:17 -08:00
edac_device_sysfs.c
edac_mc.c EDAC: Increment correct counter in edac_inc_ue_error() 2016-09-07 08:32:41 +02:00
edac_mc_sysfs.c EDAC: Fix global-out-of-bounds write when setting edac_mc_poll_msec 2019-08-04 09:34:48 +02:00
edac_module.c EDAC: Properly unwind on failure path in edac_init() 2015-02-23 13:13:07 +01:00
edac_module.h EDAC: Fix global-out-of-bounds write when setting edac_mc_poll_msec 2019-08-04 09:34:48 +02:00
edac_pci.c EDAC: Robustify workqueues destruction 2016-03-03 15:07:17 -08:00
edac_pci_sysfs.c EDAC, pci_sysfs: remove unneccessary ifdef around entire file 2014-11-11 18:17:57 +01:00
edac_stub.c EDAC, edac_stub: Drop arch-specific include 2015-05-29 22:01:00 +02:00
ghes_edac.c EDAC: Fix PAGES_TO_MiB macro misuse 2015-10-22 22:57:30 +02:00
highbank_l2_edac.c
highbank_mc_edac.c EDAC: Constify of_device_id array 2015-03-20 17:50:07 +01:00
i7core_edac.c EDAC, i7core: Fix memleaks and use-after-free on probe and remove 2018-10-10 08:52:06 +02:00
i3000_edac.c EDAC: Delete unnecessary check before calling pci_dev_put() 2014-11-19 16:33:48 +01:00
i3200_edac.c move io-64-nonatomic*.h out of asm-generic 2015-10-15 00:21:07 +02:00
i5000_edac.c EDAC, i5000, i5400: Fix definition of NRECMEMB register 2017-12-16 10:33:54 +01:00
i5100_edac.c EDAC, i5100: Convert to debugfs wrappers 2015-09-22 18:21:12 +02:00
i5400_edac.c EDAC, i5000, i5400: Fix definition of NRECMEMB register 2017-12-16 10:33:54 +01:00
i7300_edac.c Linux 3.14-rc5 2014-03-11 06:55:49 -03:00
i82443bxgx_edac.c EDAC, i82443bxgx: Don't export static symbol 2015-03-11 20:39:15 +01:00
i82860_edac.c EDAC: Delete unnecessary checks before pci_dev_put() 2015-02-23 13:06:23 +01:00
i82875p_edac.c EDAC: Delete unnecessary checks before pci_dev_put() 2015-02-23 13:06:23 +01:00
i82975x_edac.c EDAC: Delete unnecessary checks before pci_dev_put() 2015-02-23 13:06:23 +01:00
ie31200_edac.c move io-64-nonatomic*.h out of asm-generic 2015-10-15 00:21:07 +02:00
Kconfig x86/ras: Move AMD MCE injector to arch/x86/ras/ 2015-08-13 10:12:54 +02:00
Makefile EDAC: Carve out debugfs functionality 2015-09-22 12:29:46 +02:00
mce_amd.c x86/mce: Kill drain_mcelog_buffer() 2015-08-13 10:12:52 +02:00
mce_amd.h x86, mce, severity: Extend the the mce_severity mechanism to handle UCNA/DEFERRED error 2014-11-19 10:55:43 -08:00
mpc85xx_edac.c EDAC, mpc85xx: Extend error address to 64 bit 2015-05-31 12:51:08 +02:00
mpc85xx_edac.h EDAC, mpc85xx: Extend error address to 64 bit 2015-05-31 12:51:08 +02:00
mv64x60_edac.c EDAC, mv64x60: Fix an error handling path 2018-04-13 19:50:23 +02:00
mv64x60_edac.h
octeon_edac-l2c.c EDAC, octeon: Fix broken build due to model helper renames 2015-07-02 10:46:28 +02:00
octeon_edac-lmc.c EDAC, octeon: Fix an uninitialized variable warning 2018-02-16 20:09:47 +01:00
octeon_edac-pc.c EDAC, octeon: Fix broken build due to model helper renames 2015-07-02 10:46:28 +02:00
octeon_edac-pci.c
pasemi_edac.c
ppc4xx_edac.c EDAC, ppc4xx_edac: Fix module autoload for OF platform driver 2015-10-03 12:19:42 +02:00
ppc4xx_edac.h
r82600_edac.c EDAC: Remove DEFINE_PCI_DEVICE_TABLE macro 2013-12-06 10:23:41 +01:00
sb_edac.c EDAC, sb_edac: Fix missing break in switch 2017-12-09 18:42:40 +01:00
synopsys_edac.c EDAC: Constify of_device_id array 2015-03-20 17:50:07 +01:00
tile_edac.c edac: drop owner assignment from platform_drivers 2014-10-20 16:20:30 +02:00
x38_edac.c move io-64-nonatomic*.h out of asm-generic 2015-10-15 00:21:07 +02:00
xgene_edac.c EDAC, xgene: Add SoC support 2015-09-25 15:41:46 +02:00