ndctl: Work around kernel memory corruption
PATCH 1/1 ndctl: Work around kernel memory corruption
Kernel commit efda1b5d87cb ("acpi, nfit, libnvdimm: fix / harden ars_status output length handling") contained an incorrect ars status output size calculation and may overrun the buffer provided by 4 bytes. This patch adds 4 bytes to the buffer the user space allocates so that the kernel's overrun doesn't corrupt the application's heap.
See kernel patch for more details:
https://patchwork.kernel.org/patch/10563103/
--- ndctl/lib/ars.c | 11 ++++++++++- 1 file changed, 10 insertions(+), 1 deletion(-)
ndctl/lib/ars.c +10 -1
@@ -133,7 +133,16 @@ NDCTL_EXPORT struct ndctl_cmd *ndctl_bus_cmd_new_ars_status(struct ndctl_cmd *ar } size =sizeof (*cmd) + ars_cap_cmd->max_ars_out; - cmd =calloc (1 , size); + +/* +* Older kernels have a bug that miscalculates the output length of the +* ars status and will overrun the provided buffer by 4 bytes, +* corrupting the memory. Add an additional 4 bytes in the allocation +* size to prevent that corruption. See kernel patch for more details: +* +* https://patchwork.kernel.org/patch/10563103/ +*/ + cmd =calloc (1 , size +4 );if (!cmd)return NULL ;
Signature · 6 lines
2.14.4 _______________________________________________ Linux-nvdimm mailing list [email protected] https://lists.01.org/mailman/listinfo/linux-nvdimm
Quoted 11 lines · Keith Busch
Kernel commit
efda1b5d87cb("acpi, nfit, libnvdimm: fix / hardenars_statusoutput length handling") contained an incorrect ars status output size calculation and may overrun the buffer provided by 4 bytes. This patch adds 4 bytes to the buffer the user space allocates so that the kernel's overrun doesn't corrupt the application's heap.See kernel patch for more details:
https://patchwork.kernel.org/patch/10563103/
Signed-off-by Keith Busch <[email protected]>
Quoted 17 lines
--- ndctl/lib/ars.c | 11 ++++++++++- 1 file changed, 10 insertions(+), 1 deletion(-)ndctl/lib/ars.c +3
-1@@ -133,7 +133,16 @@ NDCTL_EXPORT struct ndctl_cmd *ndctl_bus_cmd_new_ars_status(struct ndctl_cmd *ar } size =sizeof (*cmd) + ars_cap_cmd->max_ars_out; - cmd =calloc (1 , size); + +/* +* Older kernels have a bug that miscalculates the output length of the
ndctl/lib/ars.c NDCTL_EXPORT struct ndctl_cmd *ndctl_bus_cmd_new_ars_status(struct ndctl_cmd *ar · line 148
Quoted 10 lines
ndctl/lib/ars.c +7
-0+* ars status and will overrun the provided buffer by 4 bytes, +* corrupting the memory. Add an additional 4 bytes in the allocation +* size to prevent that corruption. See kernel patch for more details: +* +* https://patchwork.kernel.org/patch/10563103/ +*/ + cmd =calloc (1 , size +4 );if (!cmd)return NULL ;
_______________________________________________
Linux-nvdimm mailing list
[email protected]
https://lists.01.org/mailman/listinfo/linux-nvdimm