From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from youngberry.canonical.com ([91.189.89.112]:35904 "EHLO youngberry.canonical.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751867AbcAPADd (ORCPT ); Fri, 15 Jan 2016 19:03:33 -0500 From: Kamal Mostafa To: linux-kernel@vger.kernel.org, stable@vger.kernel.org, kernel-team@lists.ubuntu.com Cc: Mathias Krause , Bjorn Helgaas , Sasha Levin , Prarit Bhargava , Kamal Mostafa Subject: [PATCH 4.2.y-ckt 062/305] PCI: Prevent out of bounds access in numa_node override Date: Fri, 15 Jan 2016 15:57:56 -0800 Message-Id: <1452902519-2754-63-git-send-email-kamal@canonical.com> In-Reply-To: <1452902519-2754-1-git-send-email-kamal@canonical.com> References: <1452902519-2754-1-git-send-email-kamal@canonical.com> Sender: stable-owner@vger.kernel.org List-ID: 4.2.8-ckt2 -stable review patch. If anyone has any objections, please let me know. ---8<------------------------------------------------------------ From: Mathias Krause commit 3dcc8d39cf15fa3ceabedcffcbd3958fe953555a upstream. Commit 1266963170f5 ("PCI: Prevent out of bounds access in numa_node override") missed that the user-provided node could also be negative. Handle this case as well to avoid out-of-bounds accesses to the node_states[] array. However, allow the special value -1, i.e. NUMA_NO_NODE, to be able to set the 'no specific node' configuration. Fixes: 1266963170f5 ("PCI: Prevent out of bounds access in numa_node override") Fixes: 63692df103e9 ("PCI: Allow numa_node override via sysfs") Signed-off-by: Mathias Krause Signed-off-by: Bjorn Helgaas CC: Sasha Levin CC: Prarit Bhargava Signed-off-by: Kamal Mostafa --- drivers/pci/pci-sysfs.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/drivers/pci/pci-sysfs.c b/drivers/pci/pci-sysfs.c index 9261868..eead54c 100644 --- a/drivers/pci/pci-sysfs.c +++ b/drivers/pci/pci-sysfs.c @@ -216,7 +216,10 @@ static ssize_t numa_node_store(struct device *dev, if (ret) return ret; - if (node >= MAX_NUMNODES || !node_online(node)) + if ((node < 0 && node != NUMA_NO_NODE) || node >= MAX_NUMNODES) + return -EINVAL; + + if (node != NUMA_NO_NODE && !node_online(node)) return -EINVAL; add_taint(TAINT_FIRMWARE_WORKAROUND, LOCKDEP_STILL_OK); -- 1.9.1