Skip to content

soc: apple: rtkit: harden syslog shared-buffer handling

Laxman Acharya Padhya asahi linux-arm-kernel lkml stable 1 version In review

Get series with b4
b4 am [email protected]

Versions newest first

  1. v2 Latest4 patches 1 replyIn review

Changes in v2 from the cover letter

- inline the one-use shared-memory bounds check
- use == 0 for the crashlog copy and < 0 for syslog copies
- split the SYSLOG_INIT leak fix into patch 1
- split the idx == n_entries change into patch 3
- make the zero-size guard independent of the leak fix
- rate limit existing malformed-syslog warnings in patch 4
- rebase onto upstream commit 0a0d1d55dad5

Patches in v2 No applies recorded yet

#Subject and filesSizeRepliesApplied
1/4soc: apple: rtkit: free syslog buffer before reinitializingdrivers/soc/apple/rtkit.c+3 -00 replies
2/4soc: apple: rtkit: bound syslog copies to the shared bufferdrivers/soc/apple/rtkit.c+35 -140 replies
3/4soc: apple: rtkit: reject syslog indices outside the entry countdrivers/soc/apple/rtkit.c+1 -10 replies
4/4soc: apple: rtkit: rate limit malformed syslog warningsdrivers/soc/apple/rtkit.c+11 -120 replies

Reviews trailers per patch

No Reviewed-by, Acked-by or Tested-by trailers for v2 yet.

Read the v2 thread

Cover letter [PATCH v2 0/4] soc: apple: rtkit: harden syslog shared-buffer handling

Split the syslog hardening into focused changes as requested. The first patch fixes the SYSLOG_INIT reinitialization leak. The second prevents zero-sized messages and out-of-bounds shared-memory copies. The third corrects the entry-count boundary, and the fourth rate limits validation warnings controlled by the coprocessor.

The index-boundary change has not been tested on Apple hardware running Linux. Asahi m1n1 describes the initialization field as COUNT, consistent with the kernel's syslog_n_entries name, but patch 3 is kept independent so it can be reverted without removing the shared-memory bounds protection.

Testing:
- arm64 GCC build of drivers/soc/apple/rtkit.o with W=1 in Docker
- scripts/checkpatch.pl --strict on each patch

Changes since v1:
- inline the one-use shared-memory bounds check
- use == 0 for the crashlog copy and < 0 for syslog copies
- split the SYSLOG_INIT leak fix into patch 1
- split the idx == n_entries change into patch 3
- make the zero-size guard independent of the leak fix
- rate limit existing malformed-syslog warnings in patch 4
- rebase onto upstream commit 0a0d1d55dad5

Laxman Acharya Padhya (4):
soc: apple: rtkit: free syslog buffer before reinitializing
soc: apple: rtkit: bound syslog copies to the shared buffer
soc: apple: rtkit: reject syslog indices outside the entry count
soc: apple: rtkit: rate limit malformed syslog warnings

 drivers/soc/apple/rtkit.c | 75 +++++++++++++++++++++++++--------------
 1 file changed, 49 insertions(+), 26 deletions(-)

base-commit: 0a0d1d55dad570724bf8c7ea83409639cfb4be9b

Signature · 1 line
2.51.2