Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1691531

[PATCH 3.18 09/28] irqchip/gic-v3: Fix out-of-bound access in gic_set_affinity

Show all headers | View raw

3.18-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Suzuki K Poulose <suzuki.poulose@arm.com>

commit 866d7c1b0a3c70387646c4e455e727a58c5d465a upstream.

The GICv3 driver doesn't check if the target CPU for gic_set_affinity
is valid before going ahead and making the changes. This triggers the
following splat with KASAN:

[  141.189434] BUG: KASAN: global-out-of-bounds in gic_set_affinity+0x8c/0x140
[  141.189704] Read of size 8 at addr ffff200009741d20 by task swapper/1/0
[  141.189958]
[  141.190158] CPU: 1 PID: 0 Comm: swapper/1 Not tainted 4.12.0-rc7
[  141.190458] Hardware name: Foundation-v8A (DT)
[  141.190658] Call trace:
[  141.190908] [<ffff200008089d70>] dump_backtrace+0x0/0x328
[  141.191224] [<ffff20000808a1b4>] show_stack+0x14/0x20
[  141.191507] [<ffff200008504c3c>] dump_stack+0xa4/0xc8
[  141.191858] [<ffff20000826c19c>] print_address_description+0x13c/0x250
[  141.192219] [<ffff20000826c5c8>] kasan_report+0x210/0x300
[  141.192547] [<ffff20000826ad54>] __asan_load8+0x84/0x98
[  141.192874] [<ffff20000854eeec>] gic_set_affinity+0x8c/0x140
[  141.193158] [<ffff200008148b14>] irq_do_set_affinity+0x54/0xb8
[  141.193473] [<ffff200008148d2c>] irq_set_affinity_locked+0x64/0xf0
[  141.193828] [<ffff200008148e00>] __irq_set_affinity+0x48/0x78
[  141.194158] [<ffff200008bc48a4>] arm_perf_starting_cpu+0x104/0x150
[  141.194513] [<ffff2000080d73bc>] cpuhp_invoke_callback+0x17c/0x1f8
[  141.194783] [<ffff2000080d94ec>] notify_cpu_starting+0x8c/0xb8
[  141.195130] [<ffff2000080911ec>] secondary_start_kernel+0x15c/0x200
[  141.195390] [<0000000080db81b4>] 0x80db81b4
[  141.195603]
[  141.195685] The buggy address belongs to the variable:
[  141.196012]  __cpu_logical_map+0x200/0x220
[  141.196176]
[  141.196315] Memory state around the buggy address:
[  141.196586]  ffff200009741c00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[  141.196913]  ffff200009741c80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[  141.197158] >ffff200009741d00: 00 00 00 00 fa fa fa fa 00 00 00 00 00 00 00 00
[  141.197487]                                ^
[  141.197758]  ffff200009741d80: 00 00 00 00 00 00 00 00 fa fa fa fa 00 00 00 00
[  141.198060]  ffff200009741e00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[  141.198358] ==================================================================
[  141.198609] Disabling lock debugging due to kernel taint
[  141.198961] CPU1: Booted secondary processor [410fd051]

This patch adds the check to make sure the cpu is valid.

Fixes: commit 021f653791ad17e03f98 ("irqchip: gic-v3: Initial support for GICv3")
Signed-off-by: Suzuki K Poulose <suzuki.poulose@arm.com>
Signed-off-by: Marc Zyngier <marc.zyngier@arm.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/irqchip/irq-gic-v3.c |    3 +++
 1 file changed, 3 insertions(+)

--- a/drivers/irqchip/irq-gic-v3.c
+++ b/drivers/irqchip/irq-gic-v3.c
@@ -531,6 +531,9 @@ static int gic_set_affinity(struct irq_d
 	int enabled;
 	u64 val;
 
+	if (cpu >= nr_cpu_ids)
+		return -EINVAL;
+
 	if (gic_irq_in_rdist(d))
 		return -EINVAL;
 

Back to linux.kernel | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

[PATCH 3.18 00/28] 3.18.62-stable review Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-19 13:20 +0200
  [PATCH 3.18 22/28] crypto: atmel - only treat EBUSY as transient if backlog Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-19 13:20 +0200
  [PATCH 3.18 25/28] sched/topology: Optimize build_group_mask() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-19 13:20 +0200
  [PATCH 3.18 16/28] fs/dcache.c: fix spin lockup issue on nlru->lock Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-19 13:20 +0200
  [PATCH 3.18 19/28] vt: fix unchecked __put_user() in tioclinux ioctls Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-19 13:20 +0200
  [PATCH 3.18 12/28] parisc: DMA API: return error instead of BUG_ON for dma ops on non dma devs Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-19 13:20 +0200
  [PATCH 3.18 08/28] cfg80211: Check if PMKID attribute is of expected size Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-19 13:30 +0200
  [PATCH 3.18 09/28] irqchip/gic-v3: Fix out-of-bound access in gic_set_affinity Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-19 13:30 +0200
  [PATCH 3.18 03/28] net: prevent sign extension in dev_get_stats() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-19 13:30 +0200
  [PATCH 3.18 14/28] tools/lib/lockdep: Reduce MAX_LOCK_DEPTH to avoid overflowing lock_chain/: Depth Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-19 13:30 +0200
  [PATCH 3.18 23/28] crypto: sha1-ssse3 - Disable avx2 Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-19 13:30 +0200
  [PATCH 3.18 07/28] cfg80211: Validate frequencies nested in NL80211_ATTR_SCAN_FREQUENCIES Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-19 13:30 +0200
  [PATCH 3.18 01/28] ipv6: avoid unregistering inet6_dev for loopback Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-19 13:30 +0200
  [PATCH 3.18 04/28] ipv6: dad: dont remove dynamic addresses if link is down Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-19 13:30 +0200
  [PATCH 3.18 11/28] parisc: use compat_sys_keyctl() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-19 13:30 +0200
  Re: [PATCH 3.18 00/28] 3.18.62-stable review Guenter Roeck <linux@roeck-us.net> - 2017-07-19 22:40 +0200
  Re: [PATCH 3.18 00/28] 3.18.62-stable review Shuah Khan <shuahkh@osg.samsung.com> - 2017-07-20 01:50 +0200
    Re: [PATCH 3.18 00/28] 3.18.62-stable review Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-20 07:10 +0200

csiph-web