git.zerfleddert.de Git - ms2-kexec/blob - kernel-patches/0004-arm-fix-init_atags_procfs-to-check-tag-hdrsize.patch

   1
   2 Delivered-To: eric.y.miao@gmail.com
   3 Received: by 10.229.89.5 with SMTP id c5cs439662qcm;
   4         Fri, 18 Dec 2009 19:48:56 -0800 (PST)
   5 Received: by 10.220.122.229 with SMTP id m37mr3710050vcr.75.1261194536337;
   6         Fri, 18 Dec 2009 19:48:56 -0800 (PST)
   7 Return-Path: <linux-arm-kernel-bounces+eric.y.miao=gmail.com@lists.infradead.org>
   8 Received: from bombadil.infradead.org (bombadil.infradead.org [18.85.46.34])
   9         by mx.google.com with ESMTP id 15si5178130vws.113.2009.12.18.19.48.55;
  10         Fri, 18 Dec 2009 19:48:56 -0800 (PST)
  11 Received-SPF: neutral (google.com: 18.85.46.34 is neither permitted nor denied by domain of linux-arm-kernel-bounces+eric.y.miao=gmail.com@lists.infradead.org) client-ip=18.85.46.34;
  12 Authentication-Results: mx.google.com; spf=neutral (google.com: 18.85.46.34 is neither permitted nor denied by domain of linux-arm-kernel-bounces+eric.y.miao=gmail.com@lists.infradead.org) smtp.mail=linux-arm-kernel-bounces+eric.y.miao=gmail.com@lists.infradead.org
  13 Received: from localhost ([::1] helo=bombadil.infradead.org)
  14         by bombadil.infradead.org with esmtp (Exim 4.69 #1 (Red Hat Linux))
  15         id 1NLqHA-0005fo-Vx; Sat, 19 Dec 2009 03:46:40 +0000
  16 Received: from mho-01-ewr.mailhop.org ([204.13.248.71])
  17         by bombadil.infradead.org with esmtps (Exim 4.69 #1 (Red Hat Linux))
  18         id 1NLqH4-0005fB-Se for linux-arm-kernel@lists.infradead.org;
  19         Sat, 19 Dec 2009 03:46:39 +0000
  20 Received: from c-67-160-239-110.hsd1.ca.comcast.net ([67.160.239.110]
  21         helo=[127.0.0.1]) by mho-01-ewr.mailhop.org with esmtpa (Exim 4.68)
  22         (envelope-from <tony@atomide.com>)
  23         id 1NLqH4-000HuN-CC; Sat, 19 Dec 2009 03:46:34 +0000
  24 X-Mail-Handler: MailHop Outbound by DynDNS
  25 X-Originating-IP: 67.160.239.110
  26 X-Report-Abuse-To: abuse@dyndns.com (see
  27         http://www.dyndns.com/services/mailhop/outbound_abuse.html for
  28         abuse reporting information)
  29 X-MHO-User: U2FsdGVkX1+sI1hhEpkgqBCPoi5GTu+G
  30 Subject: [PATCH 4/5] arm: Fix init_atags_procfs() to check tag->hdr.size
  31 To: linux-arm-kernel@lists.infradead.org
  32 From: Tony Lindgren <tony@atomide.com>
  33 Date: Fri, 18 Dec 2009 19:46:30 -0800
  34 Message-ID: <20091219034630.26198.35713.stgit@localhost>
  35 In-Reply-To: <20091219034151.26198.26570.stgit@localhost>
  36 References: <20091219034151.26198.26570.stgit@localhost>
  37 User-Agent: StGit/0.15-6-gbbd0
  38 MIME-Version: 1.0
  39 X-CRM114-Version: 20090807-BlameThorstenAndJenny ( TRE 0.7.6 (BSD) )
  40         MR-646709E3
  41 X-CRM114-CacheID: sfid-20091218_224635_034795_3362075B
  42 X-CRM114-Status: GOOD (  24.83  )
  43 X-Spam-Score: 0.0 (/)
  44 X-Spam-Report: SpamAssassin version 3.2.5 on bombadil.infradead.org summary:
  45         Content analysis details:   (0.0 points)
  46         pts rule name              description
  47         ---- ----------------------
  48         -------------------------------------------------- _SUMMARY_
  49 Cc: linux-omap@vger.kernel.org
  50 X-BeenThere: linux-arm-kernel@lists.infradead.org
  51 X-Mailman-Version: 2.1.12
  52 Precedence: list
  53 List-Id: <linux-arm-kernel.lists.infradead.org>
  54 List-Unsubscribe: <http://lists.infradead.org/mailman/options/linux-arm-kernel>,
  55         <mailto:linux-arm-kernel-request@lists.infradead.org?subject=unsubscribe>
  56 List-Archive: <http://lists.infradead.org/pipermail/linux-arm-kernel/>
  57 List-Post: <mailto:linux-arm-kernel@lists.infradead.org>
  58 List-Help: <mailto:linux-arm-kernel-request@lists.infradead.org?subject=help>
  59 List-Subscribe: <http://lists.infradead.org/mailman/listinfo/linux-arm-kernel>,
  60         <mailto:linux-arm-kernel-request@lists.infradead.org?subject=subscribe>
  61 Content-Type: text/plain; charset="us-ascii"
  62 Content-Transfer-Encoding: 7bit
  63 Sender: linux-arm-kernel-bounces@lists.infradead.org
  64 Errors-To: linux-arm-kernel-bounces+eric.y.miao=gmail.com@lists.infradead.org
  65
  66 The tag->hdr.size cannot be larger than XXX.
  67 Otherwise we can getsomething similar during boot:
  68
  69 Unable to handle kernel paging request at virtual address 61a05020
  70 ...
  71
  72 Signed-off-by: Tony Lindgren <tony@atomide.com>
  73 ---
  74  arch/arm/include/asm/setup.h   |   12 +++++++++---
  75  arch/arm/kernel/atags.c        |    2 +-
  76  arch/arm/kernel/compat.c       |    2 +-
  77  arch/arm/kernel/setup.c        |    4 ++--
  78  arch/arm/mach-orion5x/common.c |    2 +-
  79  5 files changed, 14 insertions(+), 8 deletions(-)
  80
  81 diff --git a/arch/arm/include/asm/setup.h b/arch/arm/include/asm/setup.h
  82 index 5ccce0a..3ca36bb 100644
  83 --- a/arch/arm/include/asm/setup.h
  84 +++ b/arch/arm/include/asm/setup.h
  85 @@ -21,6 +21,11 @@
  86  /* The list ends with an ATAG_NONE node. */
  87  #define ATAG_NONE      0x00000000
  88
  89 +/* Some sanity checks are needed */
  90 +#define ATAG_MAX_SZ    PAGE_SIZE
  91 +#define atag_valid(tag)                                                        \
  92 +       ((tag)->hdr.size && ((tag)->hdr.size <= ATAG_MAX_SZ))
  93 +
  94  struct tag_header {
  95         __u32 size;
  96         __u32 tag;
  97 @@ -173,9 +178,10 @@ struct tagtable {
  98         int (*parse)(const struct tag *);
  99  };
 100
 101 -#define tag_member_present(tag,member)                         \
 102 -       ((unsigned long)(&((struct tag *)0L)->member + 1)       \
 103 -               <= (tag)->hdr.size * 4)
 104 +#define tag_member_present(tag,member)                                 \
 105 +       (atag_valid(tag) &&                                             \
 106 +               (((unsigned long)(&((struct tag *)0L)->member + 1)      \
 107 +                       <= (tag)->hdr.size * 4))
 108
 109  #define tag_next(t)    ((struct tag *)((__u32 *)(t) + (t)->hdr.size))
 110  #define tag_size(type) ((sizeof(struct tag_header) + sizeof(struct type)) >> 2)
 111 diff --git a/arch/arm/kernel/atags.c b/arch/arm/kernel/atags.c
 112 index 42a1a14..14d0993 100644
 113 --- a/arch/arm/kernel/atags.c
 114 +++ b/arch/arm/kernel/atags.c
 115 @@ -51,7 +51,7 @@ static int __init init_atags_procfs(void)
 116                 return -EINVAL;
 117         }
 118
 119 -       for (; tag->hdr.size; tag = tag_next(tag))
 120 +       for (; atag_valid(tag); tag = tag_next(tag))
 121                 ;
 122
 123         /* include the terminating ATAG_NONE */
 124 diff --git a/arch/arm/kernel/compat.c b/arch/arm/kernel/compat.c
 125 index 0a13854..3e63ee1 100644
 126 --- a/arch/arm/kernel/compat.c
 127 +++ b/arch/arm/kernel/compat.c
 128 @@ -220,7 +220,7 @@ void __init convert_to_tag_list(struct tag *tags)
 129
 130  void __init squash_mem_tags(struct tag *tag)
 131  {
 132 -       for (; tag->hdr.size; tag = tag_next(tag))
 133 +       for (; atag_valid(tag); tag = tag_next(tag))
 134                 if (tag->hdr.tag == ATAG_MEM)
 135                         tag->hdr.tag = ATAG_NONE;
 136  }
 137 diff --git a/arch/arm/kernel/setup.c b/arch/arm/kernel/setup.c
 138 index c6c57b6..53d7181 100644
 139 --- a/arch/arm/kernel/setup.c
 140 +++ b/arch/arm/kernel/setup.c
 141 @@ -556,7 +556,7 @@ request_standard_resources(struct meminfo *mi, struct machine_desc *mdesc)
 142   */
 143  static int __init parse_tag_core(const struct tag *tag)
 144  {
 145 -       if (tag->hdr.size > 2) {
 146 +       if ((atag_valid(tag) && (tag->hdr.size > 2))) {
 147                 if ((tag->u.core.flags & 1) == 0)
 148                         root_mountflags &= ~MS_RDONLY;
 149                 ROOT_DEV = old_decode_dev(tag->u.core.rootdev);
 150 @@ -660,7 +660,7 @@ static int __init parse_tag(const struct tag *tag)
 151   */
 152  static void __init parse_tags(const struct tag *t)
 153  {
 154 -       for (; t->hdr.size; t = tag_next(t))
 155 +       for (; atag_valid(t); t = tag_next(t))
 156                 if (!parse_tag(t))
 157                         printk(KERN_WARNING
 158                                 "Ignoring unrecognised tag 0x%08x\n",
 159 diff --git a/arch/arm/mach-orion5x/common.c b/arch/arm/mach-orion5x/common.c
 160 index f87fa12..8afee34 100644
 161 --- a/arch/arm/mach-orion5x/common.c
 162 +++ b/arch/arm/mach-orion5x/common.c
 163 @@ -717,7 +717,7 @@ void __init orion5x_init(void)
 164  void __init tag_fixup_mem32(struct machine_desc *mdesc, struct tag *t,
 165                             char **from, struct meminfo *meminfo)
 166  {
 167 -       for (; t->hdr.size; t = tag_next(t))
 168 +       for (; atag_valid(t); t = tag_next(t))
 169                 if (t->hdr.tag == ATAG_MEM &&
 170                     (!t->u.mem.size || t->u.mem.size & ~PAGE_MASK ||
 171                      t->u.mem.start & ~PAGE_MASK)) {
 172
 173
 174 _______________________________________________
 175 linux-arm-kernel mailing list
 176 linux-arm-kernel@lists.infradead.org
 177 http://lists.infradead.org/mailman/listinfo/linux-arm-kernel