mailarchive of the pengutronix oss-tools mailing list
 help / color / mirror / Atom feed
From: Marco Felsch <m.felsch@pengutronix.de>
To: oss-tools@pengutronix.de
Cc: mfe@pengutronix.de
Subject: [OSS-Tools] [PATCH dt-utils 03/14] state: backend_storage: deal gracefully with runtime bucket corruption
Date: Fri, 14 Oct 2022 18:41:53 +0200	[thread overview]
Message-ID: <20221014164204.3812506-4-m.felsch@pengutronix.de> (raw)
In-Reply-To: <20221014164204.3812506-1-m.felsch@pengutronix.de>

This ports the following barebox commit

| commit dc5100e6ba686fafd5570ce6d972383f047c7313
| Author: Ahmad Fatoum <a.fatoum@pengutronix.de>
| Date:   Thu Mar 5 08:40:31 2020 +0100
|
|     state: backend_storage: deal gracefully with runtime bucket corruption
|
|     Corrupting an already selected bucket and then reading it again will
|     crash barebox when it attempts the refresh:
|
|       barebox$ state -l
|       barebox$ mw -d /dev/eeprom0.state 0 0x42
|       barebox$ state -l
|       ERROR: state: No meta data header found
|       state: Using bucket 1@0x00000040
|       unable to handle NULL pointer dereference at address 0x00000000
|       pc : [<4fe4f1ea>]    lr : [<4fe0bcb1>]
|       sp : 4ffefd5c  ip : 00000000  fp : 2ff68f04
|       r10: 4ffefdc8  r9 : 4b434d63  r8 : 30155f50
|       r7 : 00000024  r6 : 2ff68b60  r5 : 2ff68e90  r4 : 00000000
|       r3 : 00000024  r2 : 00000024  r1 : 30155f50  r0 : 00000000
|       Flags: Nzcv  IRQs off  FIQs off  Mode SVC_32
|       WARNING: [<4fe4f1ea>] (memcmp+0x14/0x1a) from [<4fe0bcb1>] (bucket_refresh.isra.0+0x4d/0x78)
|       WARNING: [<4fe0bcb1>] (bucket_refresh.isra.0+0x4d/0x78) from [<4fe0be1d>] (state_storage_read+0xd1/0x104)
|       WARNING: [<4fe0be1d>] (state_storage_read+0xd1/0x104) from [<4fe0a5bd>] (state_do_load+0x1d/0x78)
|       WARNING: [<4fe0a5bd>] (state_do_load+0x1d/0x78) from [<4fe04137>] (execute_command+0x23/0x4c)
|
|     The memcmp called here is an optimization to skip I/O if the used bucket
|     and the one to be refreshed compare equal. Unfortunately, if the now
|     corrupt bucket was previously the used one, bucket->len will hold the
|     old value and we'll run into a NULL pointer dereference.
|
|     While this is quite inconvenient, it appears it doesn't affect
|     correctness: after the reset, the corrupt bucket will be refreshed
|     as expected.
|
|     Improve upon this by setting the length to zero when we are NULLing the
|     buffer. The zero length of the corrupted bucket will then compare unequal
|     to used_bucket->len in bucket_refresh() and ensure we will always refresh
|     the buffer if it becomes corrupted without an intermittent reset.
|
|     Fixes: 238008b4bd8f ("state: Drop cache bucket")
|     Cc: Enrico Jörns <ejo@pengutronix.de>
|     Signed-off-by: Ahmad Fatoum <a.fatoum@pengutronix.de>
|     Signed-off-by: Sascha Hauer <s.hauer@pengutronix.de>

Signed-off-by: Marco Felsch <m.felsch@pengutronix.de>
---
 src/barebox-state/backend_storage.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/src/barebox-state/backend_storage.c b/src/barebox-state/backend_storage.c
index 509427f..458f2a9 100644
--- a/src/barebox-state/backend_storage.c
+++ b/src/barebox-state/backend_storage.c
@@ -192,6 +192,7 @@ int state_storage_read(struct state_backend_storage *storage,
 		/* Free buffer from the unused buckets */
 		free(bucket->buf);
 		bucket->buf = NULL;
+		bucket->len = 0;
 	}
 
 	/*
@@ -204,6 +205,7 @@ int state_storage_read(struct state_backend_storage *storage,
 
 	/* buffer from the used bucket is passed to the caller, do not free */
 	bucket_used->buf = NULL;
+	bucket_used->len = 0;
 
 	return 0;
 }
-- 
2.30.2




  parent reply	other threads:[~2022-10-14 16:42 UTC|newest]

Thread overview: 16+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2022-10-14 16:41 [OSS-Tools] [PATCH dt-utils 00/14] Sync Barebox-State code base Marco Felsch
2022-10-14 16:41 ` [OSS-Tools] [PATCH dt-utils 01/14] state: Remove duplicate incudes Marco Felsch
2022-10-14 16:41 ` [OSS-Tools] [PATCH dt-utils 02/14] state: backend_raw: fix ignoring unpack failures Marco Felsch
2022-10-14 16:41 ` Marco Felsch [this message]
2022-10-14 16:41 ` [OSS-Tools] [PATCH dt-utils 04/14] state: treat state with all-invalid buckets as dirty Marco Felsch
2022-10-14 16:41 ` [OSS-Tools] [PATCH dt-utils 05/14] state: remove param member from struct state_string Marco Felsch
2022-10-14 16:41 ` [OSS-Tools] [PATCH dt-utils 06/14] state: remove param member from state_uint32, state_enum32, state_mac Marco Felsch
2022-10-14 16:41 ` [OSS-Tools] [PATCH dt-utils 07/14] state: remove unused function Marco Felsch
2022-10-14 16:41 ` [OSS-Tools] [PATCH dt-utils 08/14] state: propagate failure to fixup enum32 into DT Marco Felsch
2022-10-14 16:41 ` [OSS-Tools] [PATCH dt-utils 09/14] state: add SPDX-License-Identifier for files without explicit license Marco Felsch
2022-10-14 16:42 ` [OSS-Tools] [PATCH dt-utils 10/14] state: fix typos found with codespell Marco Felsch
2022-10-14 16:42 ` [OSS-Tools] [PATCH dt-utils 11/14] common: xstrdup: don't panic on xstrdup(NULL) Marco Felsch
2022-10-14 16:42 ` [OSS-Tools] [PATCH dt-utils 12/14] libdt: add of_property_write_strings support Marco Felsch
2022-10-14 16:42 ` [OSS-Tools] [PATCH dt-utils 13/14] libdt: add partition search function Marco Felsch
2022-10-14 16:42 ` [OSS-Tools] [PATCH dt-utils 14/14] state: sync with barebox to support new backend type Marco Felsch
2022-10-21  7:37 ` [OSS-Tools] [PATCH dt-utils 00/14] Sync Barebox-State code base Marco Felsch

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20221014164204.3812506-4-m.felsch@pengutronix.de \
    --to=m.felsch@pengutronix.de \
    --cc=mfe@pengutronix.de \
    --cc=oss-tools@pengutronix.de \
    --subject='Re: [OSS-Tools] [PATCH dt-utils 03/14] state: backend_storage: deal gracefully with runtime bucket corruption' \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox