Memset the kernel copy of rtas args before using
PATCH 1/1 Memset the kernel copy of rtas args before using
The kernel copy of the rtas args struct that is read in from user space is a stack variable. This structure should be zero'ed out before we do any reads/writes to/from the user when handling a rtas call request. This patch adds a memset to do this.
I am seeing an issue in testing partition mobility, where the parts of the rtas args struct that return status top the user contain stale data.
---
arch/powerpc/kernel/rtas.c +0 -0
@@ -775,6 +775,8 @@
if (!capable(CAP_SYS_ADMIN)) return -EPERM;
+ memset(&args, 0, sizeof(args));
+
if (copy_from_user(&args, uargs, 3 * sizeof(u32)) != 0) return -EFAULT;
PATCH 1/1 Memset the kernel copy of rtas args before using
Quoted 5 lines · Nathan Fontenot
The kernel copy of the rtas args struct that is read in from user space is a stack variable. This structure should be zero'ed out before we do any reads/writes to/from the user when handling a rtas call request. This patch adds a memset to do this.
Why bother to zero the data before copying from the user? We check that they supply data for the whole input range needed.
Quoted 3 lines
I am seeing an issue in testing partition mobility, where the parts of the rtas args struct that return status top the user contain stale data.
Please change the patch to just clear the output arg range. (I"m fine not trusting firmware to set all output args based on what the user suggested the return arg count would be).
And we can do it after we decide not to return an error:
792 if (args.token == RTAS_UNKNOWN_SERVICE)
793 return -EINVAL;
794
795 /* Need to handle ibm,suspend_me call specially */
milton
Hello.
Review line 779
Quoted 12 lines · Nathan Fontenot
Index:
linux-2.6.git/arch/powerpc/kernel/rtas.c
===================================================================
---linux-2.6.git.orig/arch/powerpc/kernel/rtas.c2008-07-22
09:34:03.000000000 -0500
+++linux-2.6.git/arch/powerpc/kernel/rtas.c2008-07-25
16:06:00.000000000 -0500(quoted diff) +2
-0@@ -775,6 +775,8 @@ if (!capable(CAP_SYS_ADMIN)) return -EPERM; + memset(&args, 0, sizeof(args)); +
You could use memzero() directly -- memset(x, 0, sizeof(x))l should
boil down to it anyway...
Review line 781
Quoted 2 lines
(quoted diff) +0
-0if (copy_from_user(&args, uargs, 3 * sizeof(u32)) != 0) return -EFAULT;
WBR, Sergei