Commit 25b587fb authored by Nathan Fontenot's avatar Nathan Fontenot Committed by Michael Ellerman

powerpc/pseries: Correct possible read beyond dlpar sysfs buffer

The pasrsing of data written to the dlpar file in sysfs does not correctly
account for the possibility of reading past the end of the buffer. The code
assumes that all pieces of the command witten to the sysfs file are present
in the form "<resource> <action> <id_type> <id>".

Correct this by updating the buffer parsing code to make a local copy and
use the strsep() and sysfs_streq() routines to parse the buffer. This patch
also separates the parsing code into subroutines for each piece of the
command.
Signed-off-by: default avatarNathan Fontenot <nfont@linux.vnet.ibm.com>
Signed-off-by: default avatarMichael Ellerman <mpe@ellerman.id.au>
parent d6d56ec7
...@@ -418,84 +418,136 @@ void queue_hotplug_event(struct pseries_hp_errorlog *hp_errlog, ...@@ -418,84 +418,136 @@ void queue_hotplug_event(struct pseries_hp_errorlog *hp_errlog,
} }
} }
static ssize_t dlpar_store(struct class *class, struct class_attribute *attr, static int dlpar_parse_resource(char **cmd, struct pseries_hp_errorlog *hp_elog)
const char *buf, size_t count)
{ {
struct pseries_hp_errorlog *hp_elog; char *arg;
struct completion hotplug_done;
const char *arg;
int rc;
hp_elog = kzalloc(sizeof(*hp_elog), GFP_KERNEL); arg = strsep(cmd, " ");
if (!hp_elog) { if (!arg)
rc = -ENOMEM; return -EINVAL;
goto dlpar_store_out;
}
/* Parse out the request from the user, this will be in the form if (sysfs_streq(arg, "memory")) {
* <resource> <action> <id_type> <id>
*/
arg = buf;
if (!strncmp(arg, "memory", 6)) {
hp_elog->resource = PSERIES_HP_ELOG_RESOURCE_MEM; hp_elog->resource = PSERIES_HP_ELOG_RESOURCE_MEM;
arg += strlen("memory "); } else if (sysfs_streq(arg, "cpu")) {
} else if (!strncmp(arg, "cpu", 3)) {
hp_elog->resource = PSERIES_HP_ELOG_RESOURCE_CPU; hp_elog->resource = PSERIES_HP_ELOG_RESOURCE_CPU;
arg += strlen("cpu ");
} else { } else {
pr_err("Invalid resource specified: \"%s\"\n", buf); pr_err("Invalid resource specified.\n");
rc = -EINVAL; return -EINVAL;
goto dlpar_store_out;
} }
if (!strncmp(arg, "add", 3)) { return 0;
}
static int dlpar_parse_action(char **cmd, struct pseries_hp_errorlog *hp_elog)
{
char *arg;
arg = strsep(cmd, " ");
if (!arg)
return -EINVAL;
if (sysfs_streq(arg, "add")) {
hp_elog->action = PSERIES_HP_ELOG_ACTION_ADD; hp_elog->action = PSERIES_HP_ELOG_ACTION_ADD;
arg += strlen("add "); } else if (sysfs_streq(arg, "remove")) {
} else if (!strncmp(arg, "remove", 6)) {
hp_elog->action = PSERIES_HP_ELOG_ACTION_REMOVE; hp_elog->action = PSERIES_HP_ELOG_ACTION_REMOVE;
arg += strlen("remove ");
} else { } else {
pr_err("Invalid action specified: \"%s\"\n", buf); pr_err("Invalid action specified.\n");
rc = -EINVAL; return -EINVAL;
goto dlpar_store_out;
} }
if (!strncmp(arg, "index", 5)) { return 0;
u32 index; }
static int dlpar_parse_id_type(char **cmd, struct pseries_hp_errorlog *hp_elog)
{
char *arg;
u32 count, index;
arg = strsep(cmd, " ");
if (!arg)
return -EINVAL;
if (sysfs_streq(arg, "index")) {
hp_elog->id_type = PSERIES_HP_ELOG_ID_DRC_INDEX; hp_elog->id_type = PSERIES_HP_ELOG_ID_DRC_INDEX;
arg += strlen("index "); arg = strsep(cmd, " ");
if (!arg) {
pr_err("No DRC Index specified.\n");
return -EINVAL;
}
if (kstrtou32(arg, 0, &index)) { if (kstrtou32(arg, 0, &index)) {
rc = -EINVAL; pr_err("Invalid DRC Index specified.\n");
pr_err("Invalid drc_index specified: \"%s\"\n", buf); return -EINVAL;
goto dlpar_store_out;
} }
hp_elog->_drc_u.drc_index = cpu_to_be32(index); hp_elog->_drc_u.drc_index = cpu_to_be32(index);
} else if (!strncmp(arg, "count", 5)) { } else if (sysfs_streq(arg, "count")) {
u32 count;
hp_elog->id_type = PSERIES_HP_ELOG_ID_DRC_COUNT; hp_elog->id_type = PSERIES_HP_ELOG_ID_DRC_COUNT;
arg += strlen("count "); arg = strsep(cmd, " ");
if (!arg) {
pr_err("No DRC count specified.\n");
return -EINVAL;
}
if (kstrtou32(arg, 0, &count)) { if (kstrtou32(arg, 0, &count)) {
rc = -EINVAL; pr_err("Invalid DRC count specified.\n");
pr_err("Invalid count specified: \"%s\"\n", buf); return -EINVAL;
goto dlpar_store_out;
} }
hp_elog->_drc_u.drc_count = cpu_to_be32(count); hp_elog->_drc_u.drc_count = cpu_to_be32(count);
} else { } else {
pr_err("Invalid id_type specified: \"%s\"\n", buf); pr_err("Invalid id_type specified.\n");
rc = -EINVAL; return -EINVAL;
goto dlpar_store_out; }
return 0;
}
static ssize_t dlpar_store(struct class *class, struct class_attribute *attr,
const char *buf, size_t count)
{
struct pseries_hp_errorlog *hp_elog;
struct completion hotplug_done;
char *argbuf;
char *args;
int rc;
args = argbuf = kstrdup(buf, GFP_KERNEL);
hp_elog = kzalloc(sizeof(*hp_elog), GFP_KERNEL);
if (!hp_elog || !argbuf) {
pr_info("Could not allocate resources for DLPAR operation\n");
kfree(argbuf);
kfree(hp_elog);
return -ENOMEM;
} }
/*
* Parse out the request from the user, this will be in the form:
* <resource> <action> <id_type> <id>
*/
rc = dlpar_parse_resource(&args, hp_elog);
if (rc)
goto dlpar_store_out;
rc = dlpar_parse_action(&args, hp_elog);
if (rc)
goto dlpar_store_out;
rc = dlpar_parse_id_type(&args, hp_elog);
if (rc)
goto dlpar_store_out;
init_completion(&hotplug_done); init_completion(&hotplug_done);
queue_hotplug_event(hp_elog, &hotplug_done, &rc); queue_hotplug_event(hp_elog, &hotplug_done, &rc);
wait_for_completion(&hotplug_done); wait_for_completion(&hotplug_done);
dlpar_store_out: dlpar_store_out:
kfree(argbuf);
kfree(hp_elog); kfree(hp_elog);
if (rc)
pr_err("Could not handle DLPAR request \"%s\"\n", buf);
return rc ? rc : count; return rc ? rc : count;
} }
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment