| Message ID | 20230217131726.12666-1-alsp705@gmail.com (mailing list archive) |
|---|---|
| State | Handled Elsewhere, archived |
| Headers | show |
| Series | arch/x86/kernel/acpi/boot: fix buffer overflow on negative index in mp_config_acpi_gsi() | expand |
On Fri, Feb 17, 2023 at 2:17 PM Alexander Sapozhnikov <alsp705@gmail.com> wrote: > > Variable 'ioapic', which may receive negative value by calling > function 'mp_find_ioapic' at boot.c:465, is used at > io_apic.c:128 by passing as 1st parameter to function 'mpc_ioapic_id' > at boot.c:466 And that function uses the given value for array indexing without checking it, right? I would rather call this "out of bounds access" > Found by Linux Verification Center (linuxtesting.org) with SVACE. > > Signed-off-by: Alexander Sapozhnikov <alsp705@gmail.com> > --- > arch/x86/kernel/acpi/boot.c | 6 ++++-- > 1 file changed, 4 insertions(+), 2 deletions(-) > > diff --git a/arch/x86/kernel/acpi/boot.c b/arch/x86/kernel/acpi/boot.c > index 907cc98b1938..abb78822f164 100644 > --- a/arch/x86/kernel/acpi/boot.c > +++ b/arch/x86/kernel/acpi/boot.c > @@ -463,8 +463,10 @@ static void mp_config_acpi_gsi(struct device *dev, u32 gsi, int trigger, > mp_irq.srcbus = number; > mp_irq.srcbusirq = (((devfn >> 3) & 0x1f) << 2) | ((pin - 1) & 3); > ioapic = mp_find_ioapic(gsi); > - mp_irq.dstapic = mpc_ioapic_id(ioapic); > - mp_irq.dstirq = mp_find_ioapic_pin(ioapic, gsi); > + if (ioapic >= 0) { > + mp_irq.dstapic = mpc_ioapic_id(ioapic); > + mp_irq.dstirq = mp_find_ioapic_pin(ioapic, gsi); > + } > > mp_save_irq(&mp_irq); Is it still valid to call this if ioapic is negative? > #endif > -- > 2.34.1 >
diff --git a/arch/x86/kernel/acpi/boot.c b/arch/x86/kernel/acpi/boot.c index 907cc98b1938..abb78822f164 100644 --- a/arch/x86/kernel/acpi/boot.c +++ b/arch/x86/kernel/acpi/boot.c @@ -463,8 +463,10 @@ static void mp_config_acpi_gsi(struct device *dev, u32 gsi, int trigger, mp_irq.srcbus = number; mp_irq.srcbusirq = (((devfn >> 3) & 0x1f) << 2) | ((pin - 1) & 3); ioapic = mp_find_ioapic(gsi); - mp_irq.dstapic = mpc_ioapic_id(ioapic); - mp_irq.dstirq = mp_find_ioapic_pin(ioapic, gsi); + if (ioapic >= 0) { + mp_irq.dstapic = mpc_ioapic_id(ioapic); + mp_irq.dstirq = mp_find_ioapic_pin(ioapic, gsi); + } mp_save_irq(&mp_irq); #endif
Variable 'ioapic', which may receive negative value by calling function 'mp_find_ioapic' at boot.c:465, is used at io_apic.c:128 by passing as 1st parameter to function 'mpc_ioapic_id' at boot.c:466 Found by Linux Verification Center (linuxtesting.org) with SVACE. Signed-off-by: Alexander Sapozhnikov <alsp705@gmail.com> --- arch/x86/kernel/acpi/boot.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)