From patchwork Thu Oct 11 11:06:17 2018 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Arnd Bergmann X-Patchwork-Id: 148618 Delivered-To: patch@linaro.org Received: by 2002:a2e:8595:0:0:0:0:0 with SMTP id b21-v6csp1977357lji; Thu, 11 Oct 2018 04:08:04 -0700 (PDT) X-Google-Smtp-Source: ACcGV63D7zhCtQ/4eiTvOnkOSm3mQeJgEnPj3EJ6KIruNf8Roh7vdSWW881JfTirRkRk6yiA3Of1 X-Received: by 2002:a62:8f0c:: with SMTP id n12-v6mr1125582pfd.172.1539256084580; Thu, 11 Oct 2018 04:08:04 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1539256084; cv=none; d=google.com; s=arc-20160816; b=eZHK6QeZf3qgczzcUg3J0rdJH/C5M5wa2F/5ap9HO0/KtsC49CxTMGcJc2G5MvZa1Z JNug+KajZglqHGbhChHIFxlD50vlb2FZ1YPXN7td182g9dlZ4QhaXyH/Xh7buEzZUi8s l8cnJ93i19Mfb1f2qhYZ/B4bmEfE4y0/Z2TrfOAbkseIIqBAe8qf0bE8h7tiWvFXnC25 Xt1O8XI2XRPdqgfB5OrbJ6yjWgv4gnKonpHZnkscK88zvQjpjpoZQw4ZkuM1eycr2HMM Mjf0HnRXmbLldizZMjLeEM6IzN+EWq3k6gZE7Swtfz+p41cauIupYHAx793irUSVzAzF pefQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=errors-to:sender:content-transfer-encoding:mime-version:cc :list-subscribe:list-help:list-post:list-archive:list-unsubscribe :list-id:precedence:references:in-reply-to:message-id:date:subject :to:from:dkim-signature; bh=fWyRCkPTNSkAr8fisbRtTSX8XPQvJw1CuOmSak7ePGo=; b=gsUZOlyM42wh9dCdGxAWKzDoOdCK/IqGC5Wlpbmzz8MP1iQy63GWzf2e5MG80o5Vkh ynDL4eiNd7WPyyrZ32lBBmSmJx/pRa0WkQNTNPDi10DFB7weqjQT6cZdZb2QcWjvqQTf nbUSui73GEajQuEjHkyeJNrv7ABr4f/MTFPcWoHQyUsvqoUWwG0a9nhWvw02bNEadzsu VcuyB4SF7Zo/ecMJ6CyI9/QiDl3tceHOuWtbiPteipCz8e/Q/7x420WqW8lH22yambvQ rXmvqhw4IMSzbQvz8/ZV65JwitKLQPBKeSVCwoPlijhIfCmw/RVB2A1JU9GU6ElLefyV YZig== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@lists.infradead.org header.s=bombadil.20170209 header.b=VGcj5WAi; spf=pass (google.com: best guess record for domain of linux-mtd-bounces+patch=linaro.org@lists.infradead.org designates 2607:7c80:54:e::133 as permitted sender) smtp.mailfrom="linux-mtd-bounces+patch=linaro.org@lists.infradead.org" Return-Path: Received: from bombadil.infradead.org (bombadil.infradead.org. [2607:7c80:54:e::133]) by mx.google.com with ESMTPS id r12-v6si27062772plo.269.2018.10.11.04.08.04 for (version=TLS1_2 cipher=ECDHE-RSA-CHACHA20-POLY1305 bits=256/256); Thu, 11 Oct 2018 04:08:04 -0700 (PDT) Received-SPF: pass (google.com: best guess record for domain of linux-mtd-bounces+patch=linaro.org@lists.infradead.org designates 2607:7c80:54:e::133 as permitted sender) client-ip=2607:7c80:54:e::133; Authentication-Results: mx.google.com; dkim=pass header.i=@lists.infradead.org header.s=bombadil.20170209 header.b=VGcj5WAi; spf=pass (google.com: best guess record for domain of linux-mtd-bounces+patch=linaro.org@lists.infradead.org designates 2607:7c80:54:e::133 as permitted sender) smtp.mailfrom="linux-mtd-bounces+patch=linaro.org@lists.infradead.org" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.infradead.org; s=bombadil.20170209; h=Sender: Content-Transfer-Encoding:Content-Type:MIME-Version:Cc:List-Subscribe: List-Help:List-Post:List-Archive:List-Unsubscribe:List-Id:References: In-Reply-To:Message-Id:Date:Subject:To:From:Reply-To:Content-ID: Content-Description:Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc :Resent-Message-ID:List-Owner; bh=fWyRCkPTNSkAr8fisbRtTSX8XPQvJw1CuOmSak7ePGo=; b=VGcj5WAiWIQVmtXCSJnIKfncT5 bxk4a4LU8EYP1M8Ctx/AHN8jVYgxVfpEH2MMT/laTvuSuucAqpvHFZXJs0NLt9mESEvhUoN4ADczI Fixye3kgWorZoQlJAhqvFJTT3Ag5tvm2bL/wX5vAf1NIE5jaBUV1o7Mxru1yAqcfs1zkwISfbVg6W FOk7yqu56DB7X93NGF+kAXaRM7u63AlTwXTix69I2nvn459JuWiJGQ8XGWcnI1E3xYNSw8PP+O1FV Rr/sdxVBwvE0QpAQgF6JNqOLpav3l2aXOFDP8LW2WPeI52I0slmSpt+Rxx9x4XJqJHKmVJqi8ayVC 6Yb9m/GA==; Received: from localhost ([127.0.0.1] helo=bombadil.infradead.org) by bombadil.infradead.org with esmtp (Exim 4.90_1 #2 (Red Hat Linux)) id 1gAYoz-0005xX-1V; Thu, 11 Oct 2018 11:08:01 +0000 Received: from mout.kundenserver.de ([212.227.126.135]) by bombadil.infradead.org with esmtps (Exim 4.90_1 #2 (Red Hat Linux)) id 1gAYoc-0005il-Ep for linux-mtd@lists.infradead.org; Thu, 11 Oct 2018 11:07:53 +0000 Received: from wuerfel.lan ([109.193.40.16]) by mrelayeu.kundenserver.de (mreue011 [212.227.15.129]) with ESMTPA (Nemesis) id 1MHGTI-1fxLOP1Pqy-00DGMP; Thu, 11 Oct 2018 13:07:17 +0200 Received: from wuerfel.lan ([109.193.40.16]) by mrelayeu.kundenserver.de (mreue011 [212.227.15.129]) with ESMTPA (Nemesis) id 1MHGTI-1fxLOP1Pqy-00DGMP; Thu, 11 Oct 2018 13:07:17 +0200 From: Arnd Bergmann To: Boris Brezillon Subject: [PATCH 2/2] [v2] lib/bch: fix possible stack overrun Date: Thu, 11 Oct 2018 13:06:17 +0200 Message-Id: <20181011110639.2649053-2-arnd@arndb.de> X-Mailer: git-send-email 2.18.0 In-Reply-To: <20181011110639.2649053-1-arnd@arndb.de> References: <20181011110639.2649053-1-arnd@arndb.de> X-Provags-ID: V03:K1:kRfMw9+KH0exXxdrQTRRgqf4YBLnY35RZa99T21k5OJgRvpEiAx uGJssXABaKecJWHMO+D1N2V8v85pEFOngBkgtI/By2jeoA1x4ELo0eeqhfLiFgqsjVPKPvm uixPKrH7J1UH1A/SOl5h0ORkWxo/iXBYp34xlADPykGRBLf+s9+IvGPpHn7n+w8pjIcc5oy vj/yB0jNGWYSbrkJ/Hugw== X-Spam-Flag: NO X-UI-Out-Filterresults: notjunk:1; V01:K0:4E1Qqhf+w2E=:LQjzbtYEaENIL7HdEozUGk aiCdLKfF4yZ5o7c9dLQ8QiKWEf35ihk+fgaM0rrFgUCnnJkL63z1C2uL5cecX+R8fDn4y5b8A oRTE7EX0Fhwqjr0J/3c5y6u4MJUAu5lhIDqbDL8BlXqRMEKj1WF35yHAtI6ci8LQofqvGdDY4 SfMNCeE/0EVg1SqMHi0TUwWSe1s9T0AYZssA8CoQmKo0N3Kn0u1dttEIi6JZxkGHuoNWSbNYd nV0ZDEdo/2350bESHtcH/tZeBhA0QYbuDnhksoua6RAd1nAJtBXAIaWwXXTPW5mQMofDQJvRH lLyhrXDMpCmenY9tNXj2+1grbPOUxwABdQq35Wex1kS658GKhRakO9/Iu7oix30Hs64N+kJtb iRDgfClxfq+xjoaJIT6Cjv1tjKbyLgVw+t0NB3lgkuGfZtOrWwK8jQQnaPYnYZD0TG91FonQD wA4crqfWPaPQl3fycOg05dWFA+h0dMi9f4IkpILyCAJnRWT8xeinzYQ3fgDX3/BBUtHQU0TdW Lp+gXRVHnbtPYxQB8hiyFokIpGQSPFiK6+rrLolQioT8KNHGvN1kTDCtjpANIlIeMu+ESp2M5 dM9m0IZVgKKttrKWKteWuSMUZlprO8SS+YC8qJHHoPEGVbM70eBKhR52HmEDUYxTNA14F/fX0 ZTYm6BlHzKwCFqyrLb9H4EZ4lxg+lmKnUauePr/xNTJDXAxygHJXdUXxzz3kg7vmQuQ0= X-CRM114-Version: 20100106-BlameMichelson ( TRE 0.8.0 (BSD) ) MR-646709E3 X-CRM114-CacheID: sfid-20181011_040738_827756_C023242A X-CRM114-Status: GOOD ( 19.75 ) X-Spam-Score: 0.0 (/) X-Spam-Report: SpamAssassin version 3.4.1 on bombadil.infradead.org summary: Content analysis details: (0.0 points) pts rule name description ---- ---------------------- -------------------------------------------------- -0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no trust [212.227.126.135 listed in list.dnswl.org] X-BeenThere: linux-mtd@lists.infradead.org X-Mailman-Version: 2.1.21 Precedence: list List-Id: Linux MTD discussion mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: Arnd Bergmann , Robert Jarzmik , linux-kernel@vger.kernel.org, stable@vger.kernel.org, Marek Vasut , linux-mtd@lists.infradead.org, Richard Weinberger , Ivan Djelic , Brian Norris , David Woodhouse MIME-Version: 1.0 Sender: "linux-mtd" Errors-To: linux-mtd-bounces+patch=linaro.org@lists.infradead.org The previous patch introduced very large kernel stack usage and a Makefile change to hide the warning about it. >From what I can tell, a number of things went wrong here: - The BCH_MAX_T constant was set to the maximum value for 'n', not the maximum for 't', which is much smaller. - The stack usage is actually larger than the entire kernel stack on some architectures that can use 4KB stacks (m68k, sh, c6x), which leads to an immediate overrun. - The justification in the patch description claimed that nothing changed, however that is not the case even without the two points above: the configuration is machine specific, and most boards never use the maximum BCH_ECC_WORDS() length but instead have something much smaller. That maximum would only apply to machines that use both the maximum block size and the maximum ECC strength. The largest value for 't' that I could find is '32', which in turn leads to a 60 byte array instead of 2048 bytes. Making it '64' for future extension seems also worthwhile, with 120 bytes for the array. Anything larger won't fit into the OOB area on NAND flash. With that changed, the warning can be enabled again. Only linux-4.19+ contains the breakage, so this is only needed as a stable backport if it does not make it into the release. Fixes: 02361bc77888 ("lib/bch: Remove VLA usage") Reported-by: Ard Biesheuvel Cc: stable@vger.kernel.org Signed-off-by: Arnd Bergmann --- v2: use larget MAX_T, and add a check to init_bch, as suggested by Boris --- lib/Makefile | 1 - lib/bch.c | 17 +++++++++++++---- 2 files changed, 13 insertions(+), 5 deletions(-) -- 2.18.0 ______________________________________________________ Linux MTD discussion mailing list http://lists.infradead.org/mailman/listinfo/linux-mtd/ diff --git a/lib/Makefile b/lib/Makefile index 37fbf6f23148..a74986ff2f73 100644 --- a/lib/Makefile +++ b/lib/Makefile @@ -122,7 +122,6 @@ obj-$(CONFIG_ZLIB_INFLATE) += zlib_inflate/ obj-$(CONFIG_ZLIB_DEFLATE) += zlib_deflate/ obj-$(CONFIG_REED_SOLOMON) += reed_solomon/ obj-$(CONFIG_BCH) += bch.o -CFLAGS_bch.o := $(call cc-option,-Wframe-larger-than=4500) obj-$(CONFIG_LZO_COMPRESS) += lzo/ obj-$(CONFIG_LZO_DECOMPRESS) += lzo/ obj-$(CONFIG_LZ4_COMPRESS) += lz4/ diff --git a/lib/bch.c b/lib/bch.c index 7b0f2006698b..5db6d3a4c8a6 100644 --- a/lib/bch.c +++ b/lib/bch.c @@ -79,20 +79,19 @@ #define GF_T(_p) (CONFIG_BCH_CONST_T) #define GF_N(_p) ((1 << (CONFIG_BCH_CONST_M))-1) #define BCH_MAX_M (CONFIG_BCH_CONST_M) +#define BCH_MAX_T (CONFIG_BCH_CONST_T) #else #define GF_M(_p) ((_p)->m) #define GF_T(_p) ((_p)->t) #define GF_N(_p) ((_p)->n) -#define BCH_MAX_M 15 +#define BCH_MAX_M 15 /* 2KB */ +#define BCH_MAX_T 64 /* 64 bit correction */ #endif -#define BCH_MAX_T (((1 << BCH_MAX_M) - 1) / BCH_MAX_M) - #define BCH_ECC_WORDS(_p) DIV_ROUND_UP(GF_M(_p)*GF_T(_p), 32) #define BCH_ECC_BYTES(_p) DIV_ROUND_UP(GF_M(_p)*GF_T(_p), 8) #define BCH_ECC_MAX_WORDS DIV_ROUND_UP(BCH_MAX_M * BCH_MAX_T, 32) -#define BCH_ECC_MAX_BYTES DIV_ROUND_UP(BCH_MAX_M * BCH_MAX_T, 8) #ifndef dbg #define dbg(_fmt, args...) do {} while (0) @@ -202,6 +201,9 @@ void encode_bch(struct bch_control *bch, const uint8_t *data, const uint32_t * const tab3 = tab2 + 256*(l+1); const uint32_t *pdata, *p0, *p1, *p2, *p3; + if (WARN_ON(r_bytes > sizeof(r))) + return; + if (ecc) { /* load ecc parity bytes into internal 32-bit buffer */ load_ecc8(bch, bch->ecc_buf, ecc); @@ -1285,6 +1287,13 @@ struct bch_control *init_bch(int m, int t, unsigned int prim_poly) */ goto fail; + if (t > BCH_MAX_T) + /* + * we can support larger than 64 bits if necessary, at the + * cost of higher stack usage. + */ + goto fail; + /* sanity checks */ if ((t < 1) || (m*t >= ((1 << m)-1))) /* invalid t value */