• S
    irqchip/gic-v3: Fix out-of-bound access in gic_set_affinity · 866d7c1b
    Suzuki K Poulose 提交于
    The GICv3 driver doesn't check if the target CPU for gic_set_affinity
    is valid before going ahead and making the changes. This triggers the
    following splat with KASAN:
    
    [  141.189434] BUG: KASAN: global-out-of-bounds in gic_set_affinity+0x8c/0x140
    [  141.189704] Read of size 8 at addr ffff200009741d20 by task swapper/1/0
    [  141.189958]
    [  141.190158] CPU: 1 PID: 0 Comm: swapper/1 Not tainted 4.12.0-rc7
    [  141.190458] Hardware name: Foundation-v8A (DT)
    [  141.190658] Call trace:
    [  141.190908] [<ffff200008089d70>] dump_backtrace+0x0/0x328
    [  141.191224] [<ffff20000808a1b4>] show_stack+0x14/0x20
    [  141.191507] [<ffff200008504c3c>] dump_stack+0xa4/0xc8
    [  141.191858] [<ffff20000826c19c>] print_address_description+0x13c/0x250
    [  141.192219] [<ffff20000826c5c8>] kasan_report+0x210/0x300
    [  141.192547] [<ffff20000826ad54>] __asan_load8+0x84/0x98
    [  141.192874] [<ffff20000854eeec>] gic_set_affinity+0x8c/0x140
    [  141.193158] [<ffff200008148b14>] irq_do_set_affinity+0x54/0xb8
    [  141.193473] [<ffff200008148d2c>] irq_set_affinity_locked+0x64/0xf0
    [  141.193828] [<ffff200008148e00>] __irq_set_affinity+0x48/0x78
    [  141.194158] [<ffff200008bc48a4>] arm_perf_starting_cpu+0x104/0x150
    [  141.194513] [<ffff2000080d73bc>] cpuhp_invoke_callback+0x17c/0x1f8
    [  141.194783] [<ffff2000080d94ec>] notify_cpu_starting+0x8c/0xb8
    [  141.195130] [<ffff2000080911ec>] secondary_start_kernel+0x15c/0x200
    [  141.195390] [<0000000080db81b4>] 0x80db81b4
    [  141.195603]
    [  141.195685] The buggy address belongs to the variable:
    [  141.196012]  __cpu_logical_map+0x200/0x220
    [  141.196176]
    [  141.196315] Memory state around the buggy address:
    [  141.196586]  ffff200009741c00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
    [  141.196913]  ffff200009741c80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
    [  141.197158] >ffff200009741d00: 00 00 00 00 fa fa fa fa 00 00 00 00 00 00 00 00
    [  141.197487]                                ^
    [  141.197758]  ffff200009741d80: 00 00 00 00 00 00 00 00 fa fa fa fa 00 00 00 00
    [  141.198060]  ffff200009741e00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
    [  141.198358] ==================================================================
    [  141.198609] Disabling lock debugging due to kernel taint
    [  141.198961] CPU1: Booted secondary processor [410fd051]
    
    This patch adds the check to make sure the cpu is valid.
    
    Fixes: commit 021f6537 ("irqchip: gic-v3: Initial support for GICv3")
    Cc: stable@vger.kernel.org
    Signed-off-by: NSuzuki K Poulose <suzuki.poulose@arm.com>
    Signed-off-by: NMarc Zyngier <marc.zyngier@arm.com>
    866d7c1b
irq-gic-v3.c 35.2 KB