* [PATCH] xen/acpi: off by one in read_acpi_id()
@ 2018-03-28 11:47 Dan Carpenter
2018-03-28 11:57 ` Juergen Gross
2018-03-28 12:08 ` Joao Martins
0 siblings, 2 replies; 6+ messages in thread
From: Dan Carpenter @ 2018-03-28 11:47 UTC (permalink / raw)
To: Boris Ostrovsky, Konrad Rzeszutek Wilk
Cc: Juergen Gross, xen-devel, Joao Martins, kernel-janitors
If acpi_id is = nr_acpi_bits, then we access one element beyond the end
of the acpi_psd[] array or we set one bit beyond the end of the bit map
when we do __set_bit(acpi_id, acpi_id_cst_present);
Fixes: 59a568029181 ("xen/acpi-processor: C and P-state driver that uploads said data to hypervisor.")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
diff --git a/drivers/xen/xen-acpi-processor.c b/drivers/xen/xen-acpi-processor.c
index c80195e8fbd1..d23c9c150199 100644
--- a/drivers/xen/xen-acpi-processor.c
+++ b/drivers/xen/xen-acpi-processor.c
@@ -364,7 +364,7 @@ read_acpi_id(acpi_handle handle, u32 lvl, void *context, void **rv)
}
/* There are more ACPI Processor objects than in x2APIC or MADT.
* This can happen with incorrect ACPI SSDT declerations. */
- if (acpi_id > nr_acpi_bits) {
+ if (acpi_id >= nr_acpi_bits) {
pr_debug("We only have %u, trying to set %u\n",
nr_acpi_bits, acpi_id);
return AE_OK;
^ permalink raw reply related [flat|nested] 6+ messages in thread
* Re: [PATCH] xen/acpi: off by one in read_acpi_id()
2018-03-28 11:47 [PATCH] xen/acpi: off by one in read_acpi_id() Dan Carpenter
@ 2018-03-28 11:57 ` Juergen Gross
2018-03-28 17:15 ` Dan Carpenter
2018-03-28 12:08 ` Joao Martins
1 sibling, 1 reply; 6+ messages in thread
From: Juergen Gross @ 2018-03-28 11:57 UTC (permalink / raw)
To: Dan Carpenter, Boris Ostrovsky, Konrad Rzeszutek Wilk
Cc: xen-devel, Joao Martins, kernel-janitors
On 28/03/18 13:47, Dan Carpenter wrote:
> If acpi_id is = nr_acpi_bits, then we access one element beyond the end
> of the acpi_psd[] array or we set one bit beyond the end of the bit map
> when we do __set_bit(acpi_id, acpi_id_cst_present);
>
> Fixes: 59a568029181 ("xen/acpi-processor: C and P-state driver that uploads said data to hypervisor.")
> Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
>
> diff --git a/drivers/xen/xen-acpi-processor.c b/drivers/xen/xen-acpi-processor.c
> index c80195e8fbd1..d23c9c150199 100644
> --- a/drivers/xen/xen-acpi-processor.c
> +++ b/drivers/xen/xen-acpi-processor.c
> @@ -364,7 +364,7 @@ read_acpi_id(acpi_handle handle, u32 lvl, void *context, void **rv)
> }
> /* There are more ACPI Processor objects than in x2APIC or MADT.
> * This can happen with incorrect ACPI SSDT declerations. */
> - if (acpi_id > nr_acpi_bits) {
> + if (acpi_id >= nr_acpi_bits) {
> pr_debug("We only have %u, trying to set %u\n",
> nr_acpi_bits, acpi_id);
Can you please modify this message, too? E.g. something like:
pr_debug("max acpi id %u, trying to set %u\n",
nr_acpi_bits - 1, acpi_id);
With that:
Reviewed-by: Juergen Gross <jgross@suse.com>
Juergen
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [PATCH] xen/acpi: off by one in read_acpi_id()
2018-03-28 11:47 [PATCH] xen/acpi: off by one in read_acpi_id() Dan Carpenter
2018-03-28 11:57 ` Juergen Gross
@ 2018-03-28 12:08 ` Joao Martins
2018-03-29 9:01 ` [PATCH v2] " Dan Carpenter
1 sibling, 1 reply; 6+ messages in thread
From: Joao Martins @ 2018-03-28 12:08 UTC (permalink / raw)
To: Dan Carpenter; +Cc: Juergen Gross, xen-devel, Boris Ostrovsky, kernel-janitors
On 03/28/2018 12:47 PM, Dan Carpenter wrote:
> If acpi_id is = nr_acpi_bits, then we access one element beyond the end
> of the acpi_psd[] array or we set one bit beyond the end of the bit map
> when we do __set_bit(acpi_id, acpi_id_cst_present);
>
... or even acpi_id_present (which comes right after the condition you're fixing).
> Fixes: 59a568029181 ("xen/acpi-processor: C and P-state driver that uploads said data to hypervisor.")
> Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
>
FWIW,
Reviewed-by: Joao Martins <joao.m.martins@oracle.com>
> diff --git a/drivers/xen/xen-acpi-processor.c b/drivers/xen/xen-acpi-processor.c
> index c80195e8fbd1..d23c9c150199 100644
> --- a/drivers/xen/xen-acpi-processor.c
> +++ b/drivers/xen/xen-acpi-processor.c
> @@ -364,7 +364,7 @@ read_acpi_id(acpi_handle handle, u32 lvl, void *context, void **rv)
> }
> /* There are more ACPI Processor objects than in x2APIC or MADT.
> * This can happen with incorrect ACPI SSDT declerations. */
> - if (acpi_id > nr_acpi_bits) {
> + if (acpi_id >= nr_acpi_bits) {
> pr_debug("We only have %u, trying to set %u\n",
> nr_acpi_bits, acpi_id);
> return AE_OK;
>
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [PATCH] xen/acpi: off by one in read_acpi_id()
2018-03-28 11:57 ` Juergen Gross
@ 2018-03-28 17:15 ` Dan Carpenter
0 siblings, 0 replies; 6+ messages in thread
From: Dan Carpenter @ 2018-03-28 17:15 UTC (permalink / raw)
To: Juergen Gross; +Cc: xen-devel, Boris Ostrovsky, kernel-janitors, Joao Martins
On Wed, Mar 28, 2018 at 01:57:20PM +0200, Juergen Gross wrote:
> On 28/03/18 13:47, Dan Carpenter wrote:
> > If acpi_id is = nr_acpi_bits, then we access one element beyond the end
> > of the acpi_psd[] array or we set one bit beyond the end of the bit map
> > when we do __set_bit(acpi_id, acpi_id_cst_present);
> >
> > Fixes: 59a568029181 ("xen/acpi-processor: C and P-state driver that uploads said data to hypervisor.")
> > Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
> >
> > diff --git a/drivers/xen/xen-acpi-processor.c b/drivers/xen/xen-acpi-processor.c
> > index c80195e8fbd1..d23c9c150199 100644
> > --- a/drivers/xen/xen-acpi-processor.c
> > +++ b/drivers/xen/xen-acpi-processor.c
> > @@ -364,7 +364,7 @@ read_acpi_id(acpi_handle handle, u32 lvl, void *context, void **rv)
> > }
> > /* There are more ACPI Processor objects than in x2APIC or MADT.
> > * This can happen with incorrect ACPI SSDT declerations. */
> > - if (acpi_id > nr_acpi_bits) {
> > + if (acpi_id >= nr_acpi_bits) {
> > pr_debug("We only have %u, trying to set %u\n",
> > nr_acpi_bits, acpi_id);
>
> Can you please modify this message, too? E.g. something like:
>
> pr_debug("max acpi id %u, trying to set %u\n",
> nr_acpi_bits - 1, acpi_id);
>
> With that:
>
> Reviewed-by: Juergen Gross <jgross@suse.com>
>
Sure, let me resend.
regards,
dan carpenter
^ permalink raw reply [flat|nested] 6+ messages in thread
* [PATCH v2] xen/acpi: off by one in read_acpi_id()
2018-03-28 12:08 ` Joao Martins
@ 2018-03-29 9:01 ` Dan Carpenter
2018-03-31 18:07 ` Boris Ostrovsky
0 siblings, 1 reply; 6+ messages in thread
From: Dan Carpenter @ 2018-03-29 9:01 UTC (permalink / raw)
To: Boris Ostrovsky, Konrad Rzeszutek Wilk
Cc: Juergen Gross, xen-devel, Joao Martins, kernel-janitors
If acpi_id is = nr_acpi_bits, then we access one element beyond the end
of the acpi_psd[] array or we set one bit beyond the end of the bit map
when we do __set_bit(acpi_id, acpi_id_present);
Fixes: 59a568029181 ("xen/acpi-processor: C and P-state driver that uploads said data to hypervisor.")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Reviewed-by: Joao Martins <joao.m.martins@oracle.com>
Reviewed-by: Juergen Gross <jgross@suse.com>
diff --git a/drivers/xen/xen-acpi-processor.c b/drivers/xen/xen-acpi-processor.c
index c80195e8fbd1..b29f4e40851f 100644
--- a/drivers/xen/xen-acpi-processor.c
+++ b/drivers/xen/xen-acpi-processor.c
@@ -364,9 +364,9 @@ read_acpi_id(acpi_handle handle, u32 lvl, void *context, void **rv)
}
/* There are more ACPI Processor objects than in x2APIC or MADT.
* This can happen with incorrect ACPI SSDT declerations. */
- if (acpi_id > nr_acpi_bits) {
- pr_debug("We only have %u, trying to set %u\n",
- nr_acpi_bits, acpi_id);
+ if (acpi_id >= nr_acpi_bits) {
+ pr_debug("max acpi id %u, trying to set %u\n",
+ nr_acpi_bits - 1, acpi_id);
return AE_OK;
}
/* OK, There is a ACPI Processor object */
^ permalink raw reply related [flat|nested] 6+ messages in thread
* Re: [PATCH v2] xen/acpi: off by one in read_acpi_id()
2018-03-29 9:01 ` [PATCH v2] " Dan Carpenter
@ 2018-03-31 18:07 ` Boris Ostrovsky
0 siblings, 0 replies; 6+ messages in thread
From: Boris Ostrovsky @ 2018-03-31 18:07 UTC (permalink / raw)
To: Dan Carpenter, Konrad Rzeszutek Wilk
Cc: Juergen Gross, xen-devel, Joao Martins, kernel-janitors
On 03/29/2018 05:01 AM, Dan Carpenter wrote:
> If acpi_id is = nr_acpi_bits, then we access one element beyond the end
> of the acpi_psd[] array or we set one bit beyond the end of the bit map
> when we do __set_bit(acpi_id, acpi_id_present);
>
> Fixes: 59a568029181 ("xen/acpi-processor: C and P-state driver that uploads said data to hypervisor.")
> Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
> Reviewed-by: Joao Martins <joao.m.martins@oracle.com>
> Reviewed-by: Juergen Gross <jgross@suse.com>
Applied to for-linus-4.17
-boris
^ permalink raw reply [flat|nested] 6+ messages in thread
end of thread, other threads:[~2018-03-31 18:07 UTC | newest]
Thread overview: 6+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2018-03-28 11:47 [PATCH] xen/acpi: off by one in read_acpi_id() Dan Carpenter
2018-03-28 11:57 ` Juergen Gross
2018-03-28 17:15 ` Dan Carpenter
2018-03-28 12:08 ` Joao Martins
2018-03-29 9:01 ` [PATCH v2] " Dan Carpenter
2018-03-31 18:07 ` Boris Ostrovsky
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox