Skip to contentSkip to conversation

Memset the kernel copy of rtas args before using

PATCH In review Nathan Fontenot 3 participants 3 messages Jul 25, 2008 – Jul 26, 2008 PowerPC

lore
Share & tools
lore
#0 lore raw

PATCH 1/1 Memset the kernel copy of rtas args before using

The kernel copy of the rtas args struct that is read in from user space is a stack variable. This structure should be zero'ed out before we do any reads/writes to/from the user when handling a rtas call request. This patch adds a memset to do this.

I am seeing an issue in testing partition mobility, where the parts of the rtas args struct that return status top the user contain stale data.

---

arch/powerpc/kernel/rtas.c +0 -0
Index: linux-2.6.git/arch/powerpc/kernel/rtas.c
===================================================================
@@ -775,6 +775,8 @@
	if (!capable(CAP_SYS_ADMIN))
		return -EPERM;

+ memset(&args, 0, sizeof(args));
+

	if (copy_from_user(&args, uargs, 3 * sizeof(u32)) != 0)
		return -EFAULT;
#1 lore raw

PATCH 1/1 Memset the kernel copy of rtas args before using

Quoted 5 lines · Nathan Fontenot

The kernel copy of the rtas args struct that is read in from user space is a stack variable. This structure should be zero'ed out before we do any reads/writes to/from the user when handling a rtas call request. This patch adds a memset to do this.

Why bother to zero the data before copying from the user? We check that they supply data for the whole input range needed.

Quoted 3 lines

I am seeing an issue in testing partition mobility, where the parts of the rtas args struct that return status top the user contain stale data.

Please change the patch to just clear the output arg range. (I"m fine not trusting firmware to set all output args based on what the user suggested the return arg count would be).

And we can do it after we decide not to return an error:

792 if (args.token == RTAS_UNKNOWN_SERVICE)
793 return -EINVAL;
794
795 /* Need to handle ibm,suspend_me call specially */

milton

#2 lore raw
In reply to Nathan Fontenot

Hello.

Review line 779

Quoted 12 lines · Nathan Fontenot

Index: linux-2.6.git/arch/powerpc/kernel/rtas.c
===================================================================
--- linux-2.6.git.orig/arch/powerpc/kernel/rtas.c 2008-07-22
09:34:03.000000000 -0500
+++ linux-2.6.git/arch/powerpc/kernel/rtas.c 2008-07-25
16:06:00.000000000 -0500

(quoted diff) +2 -0
@@ -775,6 +775,8 @@
    if (!capable(CAP_SYS_ADMIN))
        return -EPERM;
 
+    memset(&args, 0, sizeof(args));
+

You could use memzero() directly -- memset(x, 0, sizeof(x))l should
boil down to it anyway...

Review line 781

Quoted 2 lines
(quoted diff) +0 -0
    if (copy_from_user(&args, uargs, 3 * sizeof(u32)) != 0)
        return -EFAULT;

WBR, Sergei