No description
  • C 98.2%
  • Assembly 1%
  • Makefile 0.3%
  • Shell 0.2%
  • Python 0.1%
Find a file
Repository files (latest commit first)
Filename Latest commit message Latest commit date
Libor Pechacek 27993365c0 powerpc/pseries: Avoid NULL pointer dereference when drmem is unavailable
commit a83836dbc53e96f13fec248ecc201d18e1e3111d upstream.

In guests without hotplugagble memory drmem structure is only zero
initialized. Trying to manipulate DLPAR parameters results in a crash.

  $ echo "memory add count 1" > /sys/kernel/dlpar
  Oops: Kernel access of bad area, sig: 11 [#1]
  LE PAGE_SIZE=64K MMU=Hash SMP NR_CPUS=2048 NUMA pSeries
  ...
  NIP:  c0000000000ff294 LR: c0000000000ff248 CTR: 0000000000000000
  REGS: c0000000fb9d3880 TRAP: 0300   Tainted: G            E      (5.5.0-rc6-2-default)
  MSR:  8000000000009033 <SF,EE,ME,IR,DR,RI,LE>  CR: 28242428  XER: 20000000
  CFAR: c0000000009a6c10 DAR: 0000000000000010 DSISR: 40000000 IRQMASK: 0
  ...
  NIP dlpar_memory+0x6e4/0xd00
  LR  dlpar_memory+0x698/0xd00
  Call Trace:
    dlpar_memory+0x698/0xd00 (unreliable)
    handle_dlpar_errorlog+0xc0/0x190
    dlpar_store+0x198/0x4a0
    kobj_attr_store+0x30/0x50
    sysfs_kf_write+0x64/0x90
    kernfs_fop_write+0x1b0/0x290
    __vfs_write+0x3c/0x70
    vfs_write+0xd0/0x260
    ksys_write+0xdc/0x130
    system_call+0x5c/0x68

Taking closer look at the code, I can see that for_each_drmem_lmb is a
macro expanding into `for (lmb = &drmem_info->lmbs[0]; lmb <=
&drmem_info->lmbs[drmem_info->n_lmbs - 1]; lmb++)`. When drmem_info->lmbs
is NULL, the loop would iterate through the whole address range if it
weren't stopped by the NULL pointer dereference on the next line.

This patch aligns for_each_drmem_lmb and for_each_drmem_lmb_in_range
macro behavior with the common C semantics, where the end marker does
not belong to the scanned range, and alters get_lmb_range() semantics.
As a side effect, the wraparound observed in the crash is prevented.

Fixes: 6c6ea53725 ("powerpc/mm: Separate ibm, dynamic-memory data from DT format")
Cc: stable@vger.kernel.org # v4.16+
Signed-off-by: Libor Pechacek <lpechacek@suse.cz>
Signed-off-by: Michal Suchanek <msuchanek@suse.de>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Link: https://lore.kernel.org/r/20200131132829.10281-1-msuchanek@suse.de
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-04-17 10:50:20 +02:00
arch powerpc/pseries: Avoid NULL pointer dereference when drmem is unavailable 2020-04-17 10:50:20 +02:00
block block, bfq: fix use-after-free in bfq_idle_slice_timer_body 2020-04-17 10:50:05 +02:00
certs
crypto crypto: rng - Fix a refcounting bug in crypto_rng_reset() 2020-04-17 10:50:16 +02:00
Documentation ALSA: hda/realtek - Remove now-unnecessary XPS 13 headphone noise fixups 2020-04-17 10:50:08 +02:00
drivers drm/amdgpu: unify fw_write_wait for new gfx9 asics 2020-04-17 10:50:20 +02:00
fs io_uring: honor original task RLIMIT_FSIZE 2020-04-17 10:50:16 +02:00
include xarray: Fix early termination of xas_for_each_marked 2020-04-17 10:50:18 +02:00
init kbuild: remove header compile test 2020-03-05 16:43:47 +01:00
ipc Revert "ipc,sem: remove uneeded sem_undo_list lock usage in exit_sem()" 2020-02-28 17:22:20 +01:00
kernel sched/core: Remove duplicate assignment in sched_tick_remote() 2020-04-17 10:50:17 +02:00
lib xarray: Fix early termination of xas_for_each_marked 2020-04-17 10:50:18 +02:00
LICENSES
mm mm, memcg: do not high throttle allocators based on wraparound 2020-04-17 10:50:17 +02:00
net cfg80211: Do not warn on same channel at the end of CSA 2020-04-17 10:49:59 +02:00
samples
scripts kconfig: introduce m32-flag and m64-flag 2020-04-08 09:08:37 +02:00
security KEYS: reaching the keys quotas correctly 2020-04-17 10:50:11 +02:00
sound ALSA: hda/realtek - Add quirk for MSI GL63 2020-04-17 10:50:08 +02:00
tools selftests/powerpc: Add tlbie_test in .gitignore 2020-04-17 10:50:19 +02:00
usr initramfs: restore default compression behavior 2020-04-08 09:08:38 +02:00
virt KVM: Check for a bad hva before dropping into the ghc slow path 2020-03-05 16:43:48 +01:00
.clang-format
.cocciconfig
.get_maintainer.ignore
.gitattributes
.gitignore
.mailmap
COPYING
CREDITS
Kbuild
Kconfig
MAINTAINERS
Makefile Linux 5.4.32 2020-04-13 10:48:18 +02:00
README

Linux kernel
============

There are several guides for kernel developers and users. These guides can
be rendered in a number of formats, like HTML and PDF. Please read
Documentation/admin-guide/README.rst first.

In order to build the documentation, use ``make htmldocs`` or
``make pdfdocs``.  The formatted documentation can also be read online at:

    https://www.kernel.org/doc/html/latest/

There are various text files in the Documentation/ subdirectory,
several of them using the Restructured Text markup notation.

Please read the Documentation/process/changes.rst file, as it contains the
requirements for building and running the kernel, and information about
the problems which may result by upgrading your kernel.