lkml.org 
[lkml]   [2017]   [Jul]   [19]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 4.12 36/84] irqchip/gic-v3: Fix out-of-bound access in gic_set_affinity
    Date
    4.12-stable review patch.  If anyone has any objections, please let me know.

    ------------------

    From: Suzuki K Poulose <suzuki.poulose@arm.com>

    commit 866d7c1b0a3c70387646c4e455e727a58c5d465a upstream.

    The GICv3 driver doesn't check if the target CPU for gic_set_affinity
    is valid before going ahead and making the changes. This triggers the
    following splat with KASAN:

    [ 141.189434] BUG: KASAN: global-out-of-bounds in gic_set_affinity+0x8c/0x140
    [ 141.189704] Read of size 8 at addr ffff200009741d20 by task swapper/1/0
    [ 141.189958]
    [ 141.190158] CPU: 1 PID: 0 Comm: swapper/1 Not tainted 4.12.0-rc7
    [ 141.190458] Hardware name: Foundation-v8A (DT)
    [ 141.190658] Call trace:
    [ 141.190908] [<ffff200008089d70>] dump_backtrace+0x0/0x328
    [ 141.191224] [<ffff20000808a1b4>] show_stack+0x14/0x20
    [ 141.191507] [<ffff200008504c3c>] dump_stack+0xa4/0xc8
    [ 141.191858] [<ffff20000826c19c>] print_address_description+0x13c/0x250
    [ 141.192219] [<ffff20000826c5c8>] kasan_report+0x210/0x300
    [ 141.192547] [<ffff20000826ad54>] __asan_load8+0x84/0x98
    [ 141.192874] [<ffff20000854eeec>] gic_set_affinity+0x8c/0x140
    [ 141.193158] [<ffff200008148b14>] irq_do_set_affinity+0x54/0xb8
    [ 141.193473] [<ffff200008148d2c>] irq_set_affinity_locked+0x64/0xf0
    [ 141.193828] [<ffff200008148e00>] __irq_set_affinity+0x48/0x78
    [ 141.194158] [<ffff200008bc48a4>] arm_perf_starting_cpu+0x104/0x150
    [ 141.194513] [<ffff2000080d73bc>] cpuhp_invoke_callback+0x17c/0x1f8
    [ 141.194783] [<ffff2000080d94ec>] notify_cpu_starting+0x8c/0xb8
    [ 141.195130] [<ffff2000080911ec>] secondary_start_kernel+0x15c/0x200
    [ 141.195390] [<0000000080db81b4>] 0x80db81b4
    [ 141.195603]
    [ 141.195685] The buggy address belongs to the variable:
    [ 141.196012] __cpu_logical_map+0x200/0x220
    [ 141.196176]
    [ 141.196315] Memory state around the buggy address:
    [ 141.196586] ffff200009741c00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
    [ 141.196913] ffff200009741c80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
    [ 141.197158] >ffff200009741d00: 00 00 00 00 fa fa fa fa 00 00 00 00 00 00 00 00
    [ 141.197487] ^
    [ 141.197758] ffff200009741d80: 00 00 00 00 00 00 00 00 fa fa fa fa 00 00 00 00
    [ 141.198060] ffff200009741e00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
    [ 141.198358] ==================================================================
    [ 141.198609] Disabling lock debugging due to kernel taint
    [ 141.198961] CPU1: Booted secondary processor [410fd051]

    This patch adds the check to make sure the cpu is valid.

    Fixes: commit 021f653791ad17e03f98 ("irqchip: gic-v3: Initial support for GICv3")
    Signed-off-by: Suzuki K Poulose <suzuki.poulose@arm.com>
    Signed-off-by: Marc Zyngier <marc.zyngier@arm.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

    ---
    drivers/irqchip/irq-gic-v3.c | 3 +++
    1 file changed, 3 insertions(+)

    --- a/drivers/irqchip/irq-gic-v3.c
    +++ b/drivers/irqchip/irq-gic-v3.c
    @@ -645,6 +645,9 @@ static int gic_set_affinity(struct irq_d
    int enabled;
    u64 val;

    + if (cpu >= nr_cpu_ids)
    + return -EINVAL;
    +
    if (gic_irq_in_rdist(d))
    return -EINVAL;


    \
     
     \ /
      Last update: 2017-07-19 12:00    [W:2.321 / U:0.152 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site