lkml.org 
[lkml]   [2021]   [Sep]   [13]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 5.4 039/144] crypto: qat - use proper type for vf_mask
    Date
    From: Giovanni Cabiddu <giovanni.cabiddu@intel.com>

    [ Upstream commit 462354d986b6a89c6449b85f17aaacf44e455216 ]

    Replace vf_mask type with unsigned long to avoid a stack-out-of-bound.

    This is to fix the following warning reported by KASAN the first time
    adf_msix_isr_ae() gets called.

    [ 692.091987] BUG: KASAN: stack-out-of-bounds in find_first_bit+0x28/0x50
    [ 692.092017] Read of size 8 at addr ffff88afdf789e60 by task swapper/32/0
    [ 692.092076] Call Trace:
    [ 692.092089] <IRQ>
    [ 692.092101] dump_stack+0x9c/0xcf
    [ 692.092132] print_address_description.constprop.0+0x18/0x130
    [ 692.092164] ? find_first_bit+0x28/0x50
    [ 692.092185] kasan_report.cold+0x7f/0x111
    [ 692.092213] ? static_obj+0x10/0x80
    [ 692.092234] ? find_first_bit+0x28/0x50
    [ 692.092262] find_first_bit+0x28/0x50
    [ 692.092288] adf_msix_isr_ae+0x16e/0x230 [intel_qat]

    Fixes: ed8ccaef52fa ("crypto: qat - Add support for SRIOV")
    Signed-off-by: Giovanni Cabiddu <giovanni.cabiddu@intel.com>
    Reviewed-by: Marco Chiappero <marco.chiappero@intel.com>
    Reviewed-by: Fiona Trahe <fiona.trahe@intel.com>
    Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
    Signed-off-by: Sasha Levin <sashal@kernel.org>
    ---
    drivers/crypto/qat/qat_common/adf_isr.c | 7 ++++---
    1 file changed, 4 insertions(+), 3 deletions(-)

    diff --git a/drivers/crypto/qat/qat_common/adf_isr.c b/drivers/crypto/qat/qat_common/adf_isr.c
    index 4898ef41fd9f..7d319c5c071c 100644
    --- a/drivers/crypto/qat/qat_common/adf_isr.c
    +++ b/drivers/crypto/qat/qat_common/adf_isr.c
    @@ -59,6 +59,8 @@
    #include "adf_transport_access_macros.h"
    #include "adf_transport_internal.h"

    +#define ADF_MAX_NUM_VFS 32
    +
    static int adf_enable_msix(struct adf_accel_dev *accel_dev)
    {
    struct adf_accel_pci *pci_dev_info = &accel_dev->accel_pci_dev;
    @@ -111,7 +113,7 @@ static irqreturn_t adf_msix_isr_ae(int irq, void *dev_ptr)
    struct adf_bar *pmisc =
    &GET_BARS(accel_dev)[hw_data->get_misc_bar_id(hw_data)];
    void __iomem *pmisc_bar_addr = pmisc->virt_addr;
    - u32 vf_mask;
    + unsigned long vf_mask;

    /* Get the interrupt sources triggered by VFs */
    vf_mask = ((ADF_CSR_RD(pmisc_bar_addr, ADF_ERRSOU5) &
    @@ -132,8 +134,7 @@ static irqreturn_t adf_msix_isr_ae(int irq, void *dev_ptr)
    * unless the VF is malicious and is attempting to
    * flood the host OS with VF2PF interrupts.
    */
    - for_each_set_bit(i, (const unsigned long *)&vf_mask,
    - (sizeof(vf_mask) * BITS_PER_BYTE)) {
    + for_each_set_bit(i, &vf_mask, ADF_MAX_NUM_VFS) {
    vf_info = accel_dev->pf.vf_info + i;

    if (!__ratelimit(&vf_info->vf2pf_ratelimit)) {
    --
    2.30.2


    \
     
     \ /
      Last update: 2021-09-13 15:24    [W:2.204 / U:0.104 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site