Repository files (latest commit first)

Filename	Latest commit message	Latest commit date
Armin Wolf 7756eb1ed1 hwmon: (gpio-fan) Fix array out of bounds access ... [ Upstream commit f233d2be38dbbb22299192292983037f01ab363c ] The driver does not check if the cooling state passed to gpio_fan_set_cur_state() exceeds the maximum cooling state as stored in fan_data->num_speeds. Since the cooling state is later used as an array index in set_fan_speed(), an array out of bounds access can occur. This can be exploited by setting the state of the thermal cooling device to arbitrary values, causing for example a kernel oops when unavailable memory is accessed this way. Example kernel oops: [ 807.987276] Unable to handle kernel paging request at virtual address ffffff80d0588064 [ 807.987369] Mem abort info: [ 807.987398] ESR = 0x96000005 [ 807.987428] EC = 0x25: DABT (current EL), IL = 32 bits [ 807.987477] SET = 0, FnV = 0 [ 807.987507] EA = 0, S1PTW = 0 [ 807.987536] FSC = 0x05: level 1 translation fault [ 807.987570] Data abort info: [ 807.987763] ISV = 0, ISS = 0x00000005 [ 807.987801] CM = 0, WnR = 0 [ 807.987832] swapper pgtable: 4k pages, 39-bit VAs, pgdp=0000000001165000 [ 807.987872] [ffffff80d0588064] pgd=0000000000000000, p4d=0000000000000000, pud=0000000000000000 [ 807.987961] Internal error: Oops: 96000005 [#1] PREEMPT SMP [ 807.987992] Modules linked in: cmac algif_hash aes_arm64 algif_skcipher af_alg bnep hci_uart btbcm bluetooth ecdh_generic ecc 8021q garp stp llc snd_soc_hdmi_codec brcmfmac vc4 brcmutil cec drm_kms_helper snd_soc_core cfg80211 snd_compress bcm2835_codec(C) snd_pcm_dmaengine syscopyarea bcm2835_isp(C) bcm2835_v4l2(C) sysfillrect v4l2_mem2mem bcm2835_mmal_vchiq(C) raspberrypi_hwmon sysimgblt videobuf2_dma_contig videobuf2_vmalloc fb_sys_fops videobuf2_memops rfkill videobuf2_v4l2 videobuf2_common i2c_bcm2835 snd_bcm2835(C) videodev snd_pcm snd_timer snd mc vc_sm_cma(C) gpio_fan uio_pdrv_genirq uio drm fuse drm_panel_orientation_quirks backlight ip_tables x_tables ipv6 [ 807.988508] CPU: 0 PID: 1321 Comm: bash Tainted: G C 5.15.56-v8+ #1575 [ 807.988548] Hardware name: Raspberry Pi 3 Model B Rev 1.2 (DT) [ 807.988574] pstate: 20000005 (nzCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--) [ 807.988608] pc : set_fan_speed.part.5+0x34/0x80 [gpio_fan] [ 807.988654] lr : gpio_fan_set_cur_state+0x34/0x50 [gpio_fan] [ 807.988691] sp : ffffffc008cf3bd0 [ 807.988710] x29: ffffffc008cf3bd0 x28: ffffff80019edac0 x27: 0000000000000000 [ 807.988762] x26: 0000000000000000 x25: 0000000000000000 x24: ffffff800747c920 [ 807.988787] x23: 000000000000000a x22: ffffff800369f000 x21: 000000001999997c [ 807.988854] x20: ffffff800369f2e8 x19: ffffff8002ae8080 x18: 0000000000000000 [ 807.988877] x17: 0000000000000000 x16: 0000000000000000 x15: 000000559e271b70 [ 807.988938] x14: 0000000000000000 x13: 0000000000000000 x12: 0000000000000000 [ 807.988960] x11: 0000000000000000 x10: ffffffc008cf3c20 x9 : ffffffcfb60c741c [ 807.989018] x8 : 000000000000000a x7 : 00000000ffffffc9 x6 : 0000000000000009 [ 807.989040] x5 : 000000000000002a x4 : 0000000000000000 x3 : ffffff800369f2e8 [ 807.989062] x2 : 000000000000e780 x1 : 0000000000000001 x0 : ffffff80d0588060 [ 807.989084] Call trace: [ 807.989091] set_fan_speed.part.5+0x34/0x80 [gpio_fan] [ 807.989113] gpio_fan_set_cur_state+0x34/0x50 [gpio_fan] [ 807.989199] cur_state_store+0x84/0xd0 [ 807.989221] dev_attr_store+0x20/0x38 [ 807.989262] sysfs_kf_write+0x4c/0x60 [ 807.989282] kernfs_fop_write_iter+0x130/0x1c0 [ 807.989298] new_sync_write+0x10c/0x190 [ 807.989315] vfs_write+0x254/0x378 [ 807.989362] ksys_write+0x70/0xf8 [ 807.989379] __arm64_sys_write+0x24/0x30 [ 807.989424] invoke_syscall+0x4c/0x110 [ 807.989442] el0_svc_common.constprop.3+0xfc/0x120 [ 807.989458] do_el0_svc+0x2c/0x90 [ 807.989473] el0_svc+0x24/0x60 [ 807.989544] el0t_64_sync_handler+0x90/0xb8 [ 807.989558] el0t_64_sync+0x1a0/0x1a4 [ 807.989579] Code: b9403801 f9402800 7100003f 8b35cc00 (b9400416) [ 807.989627] ---[ end trace 8ded4c918658445b ]--- Fix this by checking the cooling state and return an error if it exceeds the maximum cooling state. Tested on a Raspberry Pi 3. Fixes: b5cf88e46b ("(gpio-fan): Add thermal control hooks") Signed-off-by: Armin Wolf <W_Armin@gmx.de> Link: https://lore.kernel.org/r/20220830011101.178843-1-W_Armin@gmx.de Signed-off-by: Guenter Roeck <linux@roeck-us.net> Signed-off-by: Sasha Levin <sashal@kernel.org>		2022-09-15 12:04:52 +02:00
..
occ	hwmon: (occ) Fix poll rate limiting	2021-05-19 10:08:30 +02:00
pmbus	hwmon: (pmbus) Add Vin unit off handling	2022-04-15 14:18:05 +02:00
ab8500.c
abituguru.c
abituguru3.c
abx500.c
abx500.h
acpi_power_meter.c	hwmon: (acpi_power_meter) Fix potential memory leak in acpi_power_meter_add()	2020-07-09 09:37:53 +02:00
ad7314.c
ad7414.c
ad7418.c
adc128d818.c
adcxx.c
adm1021.c
adm1025.c
adm1026.c
adm1029.c
adm1031.c
adm9240.c
ads7828.c
ads7871.c
adt7x10.c
adt7x10.h
adt7310.c
adt7410.c
adt7411.c
adt7462.c
adt7470.c	hwmon: (adt7470) Fix warning on module removal	2022-05-12 12:23:44 +02:00
adt7475.c
amc6821.c
applesmc.c	hwmon: (applesmc) check status earlier.	2020-09-09 19:12:20 +02:00
as370-hwmon.c
asb100.c
asc7621.c
aspeed-pwm-tacho.c	hwmon: (aspeed-pwm-tacho) Avoid possible buffer overflow	2020-07-29 10:18:37 +02:00
asus_atk0110.c
atxp1.c
coretemp.c
da9052-hwmon.c
da9055-hwmon.c
dell-smm-hwmon.c	hwmon: (dell-smm) Speed up setting of fan speed	2022-02-16 12:52:53 +01:00
dme1737.c
ds620.c
ds1621.c
emc6w201.c
emc1403.c
emc2103.c	hwmon: (emc2103) fix unable to change fan pwm1_enable attribute	2020-07-22 09:33:14 +02:00
f71805f.c
f71882fg.c	hwmon: (f71882fg) Fix negative temperature	2022-05-18 09:47:26 +02:00
f75375s.c
fam15h_power.c
fschmd.c
ftsteutates.c
g760a.c
g762.c
gl518sm.c
gl520sm.c
gpio-fan.c	hwmon: (gpio-fan) Fix array out of bounds access	2022-09-15 12:04:52 +02:00
hih6130.c
hwmon-vid.c
hwmon.c	Revert "hwmon: Make chip parameter for with_info API mandatory"	2022-06-25 12:44:36 +02:00
i5k_amb.c
i5500_temp.c
ibmaem.c	hwmon: (ibmaem) don't call platform_device_del() if platform_device_add() fails	2022-07-07 17:36:50 +02:00
ibmpex.c
ibmpowernv.c
iio_hwmon.c
ina2xx.c
ina209.c
ina3221.c	hwmon: (ina3221) Fix PM usage counter unbalance in ina3221_write_enable	2020-12-30 11:51:17 +01:00
it87.c
jc42.c
k8temp.c
k10temp.c	hwmon: (k10temp) Add AMD family 17h model 60h PCI match	2020-06-22 09:31:19 +02:00
Kconfig	hwmon: (ltq-cputemp) restrict it to SOC_XWAY	2022-05-18 09:47:25 +02:00
lineage-pem.c
lm63.c
lm70.c
lm73.c
lm75.c
lm75.h
lm77.c
lm78.c
lm80.c	Revert "hwmon: (lm80) fix a missing check of bus read in lm80 probe"	2021-05-26 12:05:18 +02:00
lm83.c
lm85.c
lm87.c
lm90.c	hwmon: (lm90) Mark alert as broken for MAX6654	2022-02-01 17:24:38 +01:00
lm92.c
lm93.c
lm95234.c
lm95241.c
lm95245.c
lochnagar-hwmon.c
ltc2945.c
ltc2990.c
ltc4151.c
ltc4215.c
ltc4222.c
ltc4245.c
ltc4260.c
ltc4261.c
ltq-cputemp.c
Makefile
max197.c
max1111.c
max1619.c
max1668.c
max6621.c
max6639.c
max6642.c
max6650.c
max6697.c	hwmon: (max6697) Make sure the OVERT mask is set correctly	2020-07-09 09:37:53 +02:00
max16065.c
max31722.c	hwmon: (max31722) Remove non-standard ACPI device IDs	2021-07-14 16:53:23 +02:00
max31790.c	hwmon: (max31790) Fix fan speed reporting for fan7..12	2021-07-14 16:53:23 +02:00
mc13783-adc.c
mcp3021.c
menf21bmc_hwmon.c
mlxreg-fan.c	hwmon: (mlxreg-fan) Return non-zero value when fan current state is enforced from sysfs	2021-10-06 15:42:32 +02:00
nct6683.c
nct6775.c	hwmon: (nct6775) Accept PECI Calibration as temperature source for NCT6798D	2020-07-29 10:18:39 +02:00
nct7802.c
nct7904.c	hwmon: (nct7904) Correct divide by 0	2020-09-03 11:26:54 +02:00
npcm750-pwm-fan.c
nsa320-hwmon.c
ntc_thermistor.c
pc87360.c
pc87427.c
pcf8591.c
powr1220.c
pwm-fan.c	hwmon: (pwm-fan) Ensure that calculation doesn't discard big period values	2021-01-19 18:26:15 +01:00
raspberrypi-hwmon.c
s3c-hwmon.c
sch56xx-common.c	hwmon: (sch56xx-common) Replace WDOG_ACTIVE with WDOG_HW_RUNNING	2022-04-15 14:18:04 +02:00
sch56xx-common.h
sch5627.c
sch5636.c
scmi-hwmon.c	hwmon: (scmi) Fix potential buffer overflow in scmi_hwmon_probe()	2020-07-29 10:18:39 +02:00
scpi-hwmon.c	hwmon: (scpi-hwmon) shows the negative temperature properly	2021-06-23 14:41:27 +02:00
sht3x.c
sht15.c
sht21.c
shtc1.c
sis5595.c
smm665.c
smsc47b397.c
smsc47m1.c
smsc47m192.c
stts751.c
tc74.c
tc654.c
thmc50.c
tmp102.c
tmp103.c
tmp108.c
tmp401.c	hwmon: (tmp401) Add OF device ID table	2022-05-18 09:47:24 +02:00
tmp421.c	hwmon: (tmp421) fix rounding for negative values	2021-10-06 15:42:33 +02:00
ultra45_env.c
vexpress-hwmon.c
via-cputemp.c
via686a.c
vt1211.c
vt8231.c
w83l785ts.c
w83l786ng.c
w83627ehf.c
w83627hf.c
w83773g.c
w83781d.c
w83791d.c	hwmon: (w83791d) Fix NULL pointer dereference by removing unnecessary structure field	2021-10-06 15:42:31 +02:00
w83792d.c	hwmon: (w83792d) Fix NULL pointer dereference by removing unnecessary structure field	2021-10-06 15:42:30 +02:00
w83793.c	hwmon: (w83793) Fix NULL pointer dereference by removing unnecessary structure field	2021-10-06 15:42:30 +02:00
w83795.c
wm831x-hwmon.c
wm8350-hwmon.c
xgene-hwmon.c