@@ -101,16 +101,16 @@ int populate_cache_leaves(unsigned int cpu)
unsigned int level, idx;
enum cache_type type;
struct cpu_cacheinfo *this_cpu_ci = get_cpu_cacheinfo(cpu);
- struct cacheinfo *this_leaf = this_cpu_ci->info_list;
+ struct cacheinfo *infos = this_cpu_ci->info_list;
for (idx = 0, level = 1; level <= this_cpu_ci->num_levels &&
- idx < this_cpu_ci->num_leaves; idx++, level++) {
+ idx < this_cpu_ci->num_leaves; level++) {
type = get_cache_type(level);
if (type == CACHE_TYPE_SEPARATE) {
- ci_leaf_init(this_leaf++, CACHE_TYPE_DATA, level);
- ci_leaf_init(this_leaf++, CACHE_TYPE_INST, level);
+ ci_leaf_init(&infos[idx++], CACHE_TYPE_DATA, level);
+ ci_leaf_init(&infos[idx++], CACHE_TYPE_INST, level);
} else {
- ci_leaf_init(this_leaf++, type, level);
+ ci_leaf_init(&infos[idx++], type, level);
}
}
return 0;
The (percpu) cacheinfo array is allocated based on the number of cache leaves that is determined by fetch_cache_info(). For arm64 systems and when the device tree provides cache information, the number of cache levels/leaves comes from the device tree but then the cacheinfo data structures are populated by analyzing the relevant CPU registers. If the information in the device tree is incorrect and provides a smaller number of leaves than the actual one, populate_cache_leaves() happily writes past the allocated struct cacheinfo array. An example is the Renesas R-Car S4 Spider board, where the cache information is described in arch/arm64/boot/dts/renesas/r8a779f0.dtsi. The CPU nodes contain no explicit info (other than `next-level-cache`), so of_count_cache_leaves() defaults to 2. The next cache level has an explicit `cache-level` property equal to 3 and `cache-unified`, so at the first iteration in init_of_cache_level(), the level is bumped to 3 (from 1) and the leaves count is incremented to 3. So, it ends up with a total of 3 levels and 3 leaves. However, in reality there are 4 leaves because L2 does exist even if it's not described in the device tree. So, the code in populate_cache_leaves() attempts to populate the info for all 4 leaves and writes past the struct cacheinfo array. This is easily observed on boot if KASAN is enabled: 8<---------------------------------------------------------------------- BUG: KASAN: slab-out-of-bounds in populate_cache_leaves+0x314/0x388 Write of size 4 at addr ffff0004402e16c4 by task swapper/0/1 CPU: 0 UID: 0 PID: 1 Comm: swapper/0 Not tainted 6.13.0-rc6+ #14 Hardware name: Renesas Spider CPU and Breakout boards based on r8a779f0 (DT) Call trace: show_stack+0x34/0x98 (C) dump_stack_lvl+0x7c/0xa0 print_address_description.constprop.0+0x90/0x320 print_report+0x108/0x1f0 kasan_report+0xb4/0x100 __asan_report_store4_noabort+0x20/0x30 populate_cache_leaves+0x314/0x388 detect_cache_attributes+0x2f0/0x440 update_siblings_masks+0x30/0x5b0 store_cpu_topology+0x154/0x1d8 smp_prepare_cpus+0x34/0x180 kernel_init_freeable+0x338/0x480 kernel_init+0x28/0x170 ret_from_fork+0x10/0x20 Allocated by task 1: kasan_save_stack+0x2c/0x58 kasan_save_track+0x20/0x40 kasan_save_alloc_info+0x40/0x60 __kasan_kmalloc+0xd4/0xd8 __kmalloc_noprof+0x190/0x4b0 allocate_cache_info+0x90/0x188 fetch_cache_info+0x320/0x408 init_cpu_topology+0x318/0x398 smp_prepare_cpus+0x28/0x180 kernel_init_freeable+0x338/0x480 kernel_init+0x28/0x170 ret_from_fork+0x10/0x20 8<---------------------------------------------------------------------- The loop that detects/populates cache information already has a bounds check on the array size but does not account for cache levels with separate data/instructions cache. Fix this by incrementing the index for any populated leaf (instead of any populated level). Fixes: 5d425c186537 ("arm64: kernel: add support for cpu cache information") Signed-off-by: Radu Rendec <rrendec@redhat.com> --- arch/arm64/kernel/cacheinfo.c | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-)