• Vishal Verma's avatar
    libnvdimm: fix ars_status output length calculation · 286e8771
    Vishal Verma authored
    Commit efda1b5d ("acpi, nfit, libnvdimm: fix / harden ars_status output length handling")
    Introduced additional hardening for ambiguity in the ACPI spec for
    ars_status output sizing. However, it had a couple of cases mixed up.
    Where it should have been checking for (and returning) "out_field[1] -
    4" it was using "out_field[1] - 8" and vice versa.
    
    This caused a four byte discrepancy in the buffer size passed on to
    the command handler, and in some cases, this caused memory corruption
    like:
    
      ./daxdev-errors.sh: line 76: 24104 Aborted   (core dumped) ./daxdev-errors $busdev $region
      malloc(): memory corruption
      Program received signal SIGABRT, Aborted.
      [...]
      #5  0x00007ffff7865a2e in calloc () from /lib64/libc.so.6
      #6  0x00007ffff7bc2970 in ndctl_bus_cmd_new_ars_status (ars_cap=ars_cap@entry=0x6153b0) at ars.c:136
      #7  0x0000000000401644 in check_ars_status (check=0x7fffffffdeb0, bus=0x604c20) at daxdev-errors.c:144
      #8  test_daxdev_clear_error (region_name=<optimized out>, bus_name=<optimized out>)
          at daxdev-errors.c:332
    
    Cc: <stable@vger.kernel.org>
    Cc: Dave Jiang <dave.jiang@intel.com>
    Cc: Keith Busch <keith.busch@intel.com>
    Cc: Lukasz Dorau <lukasz.dorau@intel.com>
    Cc: Dan Williams <dan.j.williams@intel.com>
    Fixes: efda1b5d ("acpi, nfit, libnvdimm: fix / harden ars_status output length handling")
    Signed-off-by: default avatarVishal Verma <vishal.l.verma@intel.com>
    Reviewed-by: default avatarKeith Busch <keith.busch@intel.com>
    Signed-of-by: default avatarDave Jiang <dave.jiang@intel.com>
    286e8771
bus.c 28.3 KB