* [PATCH] arch/x86/kernel/acpi/boot: fix buffer overflow on negative index in mp_config_acpi_gsi()
@ 2023-02-17 13:17 Alexander Sapozhnikov
2023-03-17 17:45 ` Rafael J. Wysocki
0 siblings, 1 reply; 3+ messages in thread
From: Alexander Sapozhnikov @ 2023-02-17 13:17 UTC (permalink / raw)
To: Rafael J. Wysocki
Cc: Alexander Sapozhnikov, Len Brown, Pavel Machek, Thomas Gleixner,
Ingo Molnar, Borislav Petkov, Dave Hansen, x86, H. Peter Anvin,
linux-pm, linux-kernel, lvc-project
Variable 'ioapic', which may receive negative value by calling
function 'mp_find_ioapic' at boot.c:465, is used at
io_apic.c:128 by passing as 1st parameter to function 'mpc_ioapic_id'
at boot.c:466
Found by Linux Verification Center (linuxtesting.org) with SVACE.
Signed-off-by: Alexander Sapozhnikov <alsp705@gmail.com>
---
arch/x86/kernel/acpi/boot.c | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-)
diff --git a/arch/x86/kernel/acpi/boot.c b/arch/x86/kernel/acpi/boot.c
index 907cc98b1938..abb78822f164 100644
--- a/arch/x86/kernel/acpi/boot.c
+++ b/arch/x86/kernel/acpi/boot.c
@@ -463,8 +463,10 @@ static void mp_config_acpi_gsi(struct device *dev, u32 gsi, int trigger,
mp_irq.srcbus = number;
mp_irq.srcbusirq = (((devfn >> 3) & 0x1f) << 2) | ((pin - 1) & 3);
ioapic = mp_find_ioapic(gsi);
- mp_irq.dstapic = mpc_ioapic_id(ioapic);
- mp_irq.dstirq = mp_find_ioapic_pin(ioapic, gsi);
+ if (ioapic >= 0) {
+ mp_irq.dstapic = mpc_ioapic_id(ioapic);
+ mp_irq.dstirq = mp_find_ioapic_pin(ioapic, gsi);
+ }
mp_save_irq(&mp_irq);
#endif
--
2.34.1
^ permalink raw reply [flat|nested] 3+ messages in thread* Re: [PATCH] arch/x86/kernel/acpi/boot: fix buffer overflow on negative index in mp_config_acpi_gsi()
2023-02-17 13:17 [PATCH] arch/x86/kernel/acpi/boot: fix buffer overflow on negative index in mp_config_acpi_gsi() Alexander Sapozhnikov
@ 2023-03-17 17:45 ` Rafael J. Wysocki
0 siblings, 0 replies; 3+ messages in thread
From: Rafael J. Wysocki @ 2023-03-17 17:45 UTC (permalink / raw)
To: Alexander Sapozhnikov
Cc: Rafael J. Wysocki, Len Brown, Pavel Machek, Thomas Gleixner,
Ingo Molnar, Borislav Petkov, Dave Hansen, x86, H. Peter Anvin,
linux-pm, linux-kernel, lvc-project
On Fri, Feb 17, 2023 at 2:17 PM Alexander Sapozhnikov <alsp705@gmail.com> wrote:
>
> Variable 'ioapic', which may receive negative value by calling
> function 'mp_find_ioapic' at boot.c:465, is used at
> io_apic.c:128 by passing as 1st parameter to function 'mpc_ioapic_id'
> at boot.c:466
And that function uses the given value for array indexing without
checking it, right?
I would rather call this "out of bounds access"
> Found by Linux Verification Center (linuxtesting.org) with SVACE.
>
> Signed-off-by: Alexander Sapozhnikov <alsp705@gmail.com>
> ---
> arch/x86/kernel/acpi/boot.c | 6 ++++--
> 1 file changed, 4 insertions(+), 2 deletions(-)
>
> diff --git a/arch/x86/kernel/acpi/boot.c b/arch/x86/kernel/acpi/boot.c
> index 907cc98b1938..abb78822f164 100644
> --- a/arch/x86/kernel/acpi/boot.c
> +++ b/arch/x86/kernel/acpi/boot.c
> @@ -463,8 +463,10 @@ static void mp_config_acpi_gsi(struct device *dev, u32 gsi, int trigger,
> mp_irq.srcbus = number;
> mp_irq.srcbusirq = (((devfn >> 3) & 0x1f) << 2) | ((pin - 1) & 3);
> ioapic = mp_find_ioapic(gsi);
> - mp_irq.dstapic = mpc_ioapic_id(ioapic);
> - mp_irq.dstirq = mp_find_ioapic_pin(ioapic, gsi);
> + if (ioapic >= 0) {
> + mp_irq.dstapic = mpc_ioapic_id(ioapic);
> + mp_irq.dstirq = mp_find_ioapic_pin(ioapic, gsi);
> + }
>
> mp_save_irq(&mp_irq);
Is it still valid to call this if ioapic is negative?
> #endif
> --
> 2.34.1
>
^ permalink raw reply [flat|nested] 3+ messages in thread
* [PATCH] arch/x86/kernel/acpi/boot: fix buffer overflow on negative index in mp_config_acpi_gsi()
@ 2023-02-17 12:23 Alexander Sapozhnikov
0 siblings, 0 replies; 3+ messages in thread
From: Alexander Sapozhnikov @ 2023-02-17 12:23 UTC (permalink / raw)
To: Rafael J. Wysocki
Cc: Alexander Sapozhnikov, Len Brown, Pavel Machek, Thomas Gleixner,
Ingo Molnar, Borislav Petkov, Dave Hansen, x86, H. Peter Anvin,
linux-pm, linux-kernel, lvc-project
Found by Linux Verification Center (linuxtesting.org) with SVACE.
Signed-off-by: Alexander Sapozhnikov <alsp705@gmail.com>
---
arch/x86/kernel/acpi/boot.c | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-)
diff --git a/arch/x86/kernel/acpi/boot.c b/arch/x86/kernel/acpi/boot.c
index 907cc98b1938..abb78822f164 100644
--- a/arch/x86/kernel/acpi/boot.c
+++ b/arch/x86/kernel/acpi/boot.c
@@ -463,8 +463,10 @@ static void mp_config_acpi_gsi(struct device *dev, u32 gsi, int trigger,
mp_irq.srcbus = number;
mp_irq.srcbusirq = (((devfn >> 3) & 0x1f) << 2) | ((pin - 1) & 3);
ioapic = mp_find_ioapic(gsi);
- mp_irq.dstapic = mpc_ioapic_id(ioapic);
- mp_irq.dstirq = mp_find_ioapic_pin(ioapic, gsi);
+ if (ioapic >= 0) {
+ mp_irq.dstapic = mpc_ioapic_id(ioapic);
+ mp_irq.dstirq = mp_find_ioapic_pin(ioapic, gsi);
+ }
mp_save_irq(&mp_irq);
#endif
--
2.34.1
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2023-03-17 17:46 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2023-02-17 13:17 [PATCH] arch/x86/kernel/acpi/boot: fix buffer overflow on negative index in mp_config_acpi_gsi() Alexander Sapozhnikov
2023-03-17 17:45 ` Rafael J. Wysocki
-- strict thread matches above, loose matches on Subject: below --
2023-02-17 12:23 Alexander Sapozhnikov
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®