From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: linux-kernel@vger.kernel.org
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
stable@vger.kernel.org, Suzuki K Poulose <suzuki.poulose@arm.com>,
Marc Zyngier <marc.zyngier@arm.com>
Subject: [PATCH 4.9 30/72] irqchip/gic-v3: Fix out-of-bound access in gic_set_affinity
Date: Wed, 19 Jul 2017 12:24:24 +0200 [thread overview]
Message-ID: <20170719102440.711094456@linuxfoundation.org> (raw)
In-Reply-To: <20170719102435.760649060@linuxfoundation.org>
4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Suzuki K Poulose <suzuki.poulose@arm.com>
commit 866d7c1b0a3c70387646c4e455e727a58c5d465a upstream.
The GICv3 driver doesn't check if the target CPU for gic_set_affinity
is valid before going ahead and making the changes. This triggers the
following splat with KASAN:
[ 141.189434] BUG: KASAN: global-out-of-bounds in gic_set_affinity+0x8c/0x140
[ 141.189704] Read of size 8 at addr ffff200009741d20 by task swapper/1/0
[ 141.189958]
[ 141.190158] CPU: 1 PID: 0 Comm: swapper/1 Not tainted 4.12.0-rc7
[ 141.190458] Hardware name: Foundation-v8A (DT)
[ 141.190658] Call trace:
[ 141.190908] [<ffff200008089d70>] dump_backtrace+0x0/0x328
[ 141.191224] [<ffff20000808a1b4>] show_stack+0x14/0x20
[ 141.191507] [<ffff200008504c3c>] dump_stack+0xa4/0xc8
[ 141.191858] [<ffff20000826c19c>] print_address_description+0x13c/0x250
[ 141.192219] [<ffff20000826c5c8>] kasan_report+0x210/0x300
[ 141.192547] [<ffff20000826ad54>] __asan_load8+0x84/0x98
[ 141.192874] [<ffff20000854eeec>] gic_set_affinity+0x8c/0x140
[ 141.193158] [<ffff200008148b14>] irq_do_set_affinity+0x54/0xb8
[ 141.193473] [<ffff200008148d2c>] irq_set_affinity_locked+0x64/0xf0
[ 141.193828] [<ffff200008148e00>] __irq_set_affinity+0x48/0x78
[ 141.194158] [<ffff200008bc48a4>] arm_perf_starting_cpu+0x104/0x150
[ 141.194513] [<ffff2000080d73bc>] cpuhp_invoke_callback+0x17c/0x1f8
[ 141.194783] [<ffff2000080d94ec>] notify_cpu_starting+0x8c/0xb8
[ 141.195130] [<ffff2000080911ec>] secondary_start_kernel+0x15c/0x200
[ 141.195390] [<0000000080db81b4>] 0x80db81b4
[ 141.195603]
[ 141.195685] The buggy address belongs to the variable:
[ 141.196012] __cpu_logical_map+0x200/0x220
[ 141.196176]
[ 141.196315] Memory state around the buggy address:
[ 141.196586] ffff200009741c00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[ 141.196913] ffff200009741c80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[ 141.197158] >ffff200009741d00: 00 00 00 00 fa fa fa fa 00 00 00 00 00 00 00 00
[ 141.197487] ^
[ 141.197758] ffff200009741d80: 00 00 00 00 00 00 00 00 fa fa fa fa 00 00 00 00
[ 141.198060] ffff200009741e00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[ 141.198358] ==================================================================
[ 141.198609] Disabling lock debugging due to kernel taint
[ 141.198961] CPU1: Booted secondary processor [410fd051]
This patch adds the check to make sure the cpu is valid.
Fixes: commit 021f653791ad17e03f98 ("irqchip: gic-v3: Initial support for GICv3")
Signed-off-by: Suzuki K Poulose <suzuki.poulose@arm.com>
Signed-off-by: Marc Zyngier <marc.zyngier@arm.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/irqchip/irq-gic-v3.c | 3 +++
1 file changed, 3 insertions(+)
--- a/drivers/irqchip/irq-gic-v3.c
+++ b/drivers/irqchip/irq-gic-v3.c
@@ -646,6 +646,9 @@ static int gic_set_affinity(struct irq_d
int enabled;
u64 val;
+ if (cpu >= nr_cpu_ids)
+ return -EINVAL;
+
if (gic_irq_in_rdist(d))
return -EINVAL;
next prev parent reply other threads:[~2017-07-19 10:26 UTC|newest]
Thread overview: 67+ messages / expand[flat|nested] mbox.gz Atom feed top
2017-07-19 10:23 [PATCH 4.9 00/72] 4.9.39-stable review Greg Kroah-Hartman
2017-07-19 10:23 ` [PATCH 4.9 01/72] xen-netfront: Rework the fix for Rx stall during OOM and network stress Greg Kroah-Hartman
2017-07-19 10:23 ` [PATCH 4.9 02/72] net_sched: fix error recovery at qdisc creation Greg Kroah-Hartman
2017-07-19 10:23 ` [PATCH 4.9 03/72] net: sched: Fix one possible panic when no destroy callback Greg Kroah-Hartman
2017-07-19 10:23 ` [PATCH 4.9 04/72] net/phy: micrel: configure intterupts after autoneg workaround Greg Kroah-Hartman
2017-07-19 10:23 ` [PATCH 4.9 05/72] ipv6: avoid unregistering inet6_dev for loopback Greg Kroah-Hartman
2017-07-19 10:24 ` [PATCH 4.9 06/72] net: dp83640: Avoid NULL pointer dereference Greg Kroah-Hartman
2017-07-19 10:24 ` [PATCH 4.9 07/72] tcp: reset sk_rx_dst in tcp_disconnect() Greg Kroah-Hartman
2017-07-19 10:24 ` [PATCH 4.9 08/72] net: prevent sign extension in dev_get_stats() Greg Kroah-Hartman
2017-07-19 10:24 ` [PATCH 4.9 09/72] bridge: mdb: fix leak on complete_info ptr on fail path Greg Kroah-Hartman
2017-07-19 10:24 ` [PATCH 4.9 10/72] rocker: move dereference before free Greg Kroah-Hartman
2017-07-19 10:24 ` [PATCH 4.9 11/72] bpf: prevent leaking pointer via xadd on unpriviledged Greg Kroah-Hartman
2017-07-19 10:24 ` [PATCH 4.9 13/72] net/mlx5: Cancel delayed recovery work when unloading the driver Greg Kroah-Hartman
2017-07-19 10:24 ` [PATCH 4.9 14/72] liquidio: fix bug in soft reset failure detection Greg Kroah-Hartman
2017-07-19 10:24 ` [PATCH 4.9 15/72] net/mlx5e: Fix TX carrier errors report in get stats ndo Greg Kroah-Hartman
2017-07-19 10:24 ` [PATCH 4.9 16/72] ipv6: dad: dont remove dynamic addresses if link is down Greg Kroah-Hartman
2017-07-19 10:24 ` [PATCH 4.9 17/72] vxlan: fix hlist corruption Greg Kroah-Hartman
2017-07-19 10:24 ` [PATCH 4.9 18/72] net: core: Fix slab-out-of-bounds in netdev_stats_to_stats64 Greg Kroah-Hartman
2017-07-19 10:24 ` [PATCH 4.9 20/72] vrf: fix bug_on triggered by rx when destroying a vrf Greg Kroah-Hartman
2017-07-19 10:24 ` [PATCH 4.9 21/72] rds: tcp: use sock_create_lite() to create the accept socket Greg Kroah-Hartman
2017-07-19 10:24 ` [PATCH 4.9 23/72] brcmfmac: Fix a memory leak in error handling path in brcmf_cfg80211_attach Greg Kroah-Hartman
2017-07-19 10:24 ` [PATCH 4.9 24/72] brcmfmac: Fix glom_skb leak in brcmf_sdiod_recv_chain Greg Kroah-Hartman
2017-07-19 10:24 ` [PATCH 4.9 25/72] sfc: dont read beyond unicast address list Greg Kroah-Hartman
2017-07-19 10:24 ` [PATCH 4.9 26/72] cfg80211: Define nla_policy for NL80211_ATTR_LOCAL_MESH_POWER_MODE Greg Kroah-Hartman
2017-07-19 10:24 ` [PATCH 4.9 27/72] cfg80211: Validate frequencies nested in NL80211_ATTR_SCAN_FREQUENCIES Greg Kroah-Hartman
2017-07-19 10:24 ` [PATCH 4.9 28/72] cfg80211: Check if PMKID attribute is of expected size Greg Kroah-Hartman
2017-07-19 10:24 ` [PATCH 4.9 29/72] cfg80211: Check if NAN service ID " Greg Kroah-Hartman
2017-07-19 10:24 ` Greg Kroah-Hartman [this message]
2017-07-19 10:24 ` [PATCH 4.9 31/72] parisc: Report SIGSEGV instead of SIGBUS when running out of stack Greg Kroah-Hartman
2017-07-19 10:24 ` [PATCH 4.9 32/72] parisc: use compat_sys_keyctl() Greg Kroah-Hartman
2017-07-19 10:24 ` [PATCH 4.9 33/72] parisc: DMA API: return error instead of BUG_ON for dma ops on non dma devs Greg Kroah-Hartman
2017-07-19 10:24 ` [PATCH 4.9 34/72] parisc/mm: Ensure IRQs are off in switch_mm() Greg Kroah-Hartman
2017-07-19 10:24 ` [PATCH 4.9 35/72] tools/lib/lockdep: Reduce MAX_LOCK_DEPTH to avoid overflowing lock_chain/: Depth Greg Kroah-Hartman
2017-07-19 10:24 ` [PATCH 4.9 36/72] thp, mm: fix crash due race in MADV_FREE handling Greg Kroah-Hartman
2017-07-19 10:24 ` [PATCH 4.9 37/72] kernel/extable.c: mark core_kernel_text notrace Greg Kroah-Hartman
2017-07-19 10:24 ` [PATCH 4.9 38/72] mm/list_lru.c: fix list_lru_count_node() to be race free Greg Kroah-Hartman
2017-07-19 10:24 ` [PATCH 4.9 39/72] fs/dcache.c: fix spin lockup issue on nlru->lock Greg Kroah-Hartman
2017-07-19 10:24 ` [PATCH 4.9 40/72] checkpatch: silence perl 5.26.0 unescaped left brace warnings Greg Kroah-Hartman
2017-07-19 10:24 ` [PATCH 4.9 41/72] binfmt_elf: use ELF_ET_DYN_BASE only for PIE Greg Kroah-Hartman
2017-07-19 10:24 ` [PATCH 4.9 42/72] arm: move ELF_ET_DYN_BASE to 4MB Greg Kroah-Hartman
2017-07-19 10:24 ` [PATCH 4.9 43/72] arm64: move ELF_ET_DYN_BASE to 4GB / 4MB Greg Kroah-Hartman
2017-07-19 10:24 ` [PATCH 4.9 44/72] powerpc: " Greg Kroah-Hartman
2017-07-19 10:24 ` [PATCH 4.9 45/72] s390: reduce ELF_ET_DYN_BASE Greg Kroah-Hartman
2017-07-19 10:24 ` [PATCH 4.9 46/72] exec: Limit arg stack to at most 75% of _STK_LIM Greg Kroah-Hartman
2017-07-19 10:24 ` [PATCH 4.9 47/72] ARM64: dts: marvell: armada37xx: Fix timer interrupt specifiers Greg Kroah-Hartman
2017-07-19 10:24 ` [PATCH 4.9 48/72] vt: fix unchecked __put_user() in tioclinux ioctls Greg Kroah-Hartman
2017-07-19 10:24 ` [PATCH 4.9 49/72] rcu: Add memory barriers for NOCB leader wakeup Greg Kroah-Hartman
2017-07-19 10:24 ` [PATCH 4.9 50/72] nvmem: core: fix leaks on registration errors Greg Kroah-Hartman
2017-07-19 10:24 ` [PATCH 4.9 51/72] mnt: In umount propagation reparent in a separate pass Greg Kroah-Hartman
2017-07-19 10:24 ` [PATCH 4.9 52/72] mnt: In propgate_umount handle visiting mounts in any order Greg Kroah-Hartman
2017-07-19 10:24 ` [PATCH 4.9 53/72] mnt: Make propagate_umount less slow for overlapping mount propagation trees Greg Kroah-Hartman
2017-07-19 10:24 ` [PATCH 4.9 54/72] selftests/capabilities: Fix the test_execve test Greg Kroah-Hartman
2017-07-19 10:24 ` [PATCH 4.9 57/72] crypto: atmel - only treat EBUSY as transient if backlog Greg Kroah-Hartman
2017-07-19 10:24 ` [PATCH 4.9 58/72] crypto: sha1-ssse3 - Disable avx2 Greg Kroah-Hartman
2017-07-19 10:24 ` [PATCH 4.9 61/72] Revert "sched/core: Optimize SCHED_SMT" Greg Kroah-Hartman
2017-07-19 10:24 ` [PATCH 4.9 62/72] sched/fair, cpumask: Export for_each_cpu_wrap() Greg Kroah-Hartman
2017-07-19 10:24 ` [PATCH 4.9 63/72] sched/topology: Fix building of overlapping sched-groups Greg Kroah-Hartman
2017-07-19 10:24 ` [PATCH 4.9 64/72] sched/topology: Optimize build_group_mask() Greg Kroah-Hartman
2017-07-19 10:24 ` [PATCH 4.9 65/72] sched/topology: Fix overlapping sched_group_mask Greg Kroah-Hartman
2017-07-19 10:25 ` [PATCH 4.9 66/72] PM / wakeirq: Convert to SRCU Greg Kroah-Hartman
2017-07-19 10:25 ` [PATCH 4.9 67/72] PM / QoS: return -EINVAL for bogus strings Greg Kroah-Hartman
2017-07-19 10:25 ` [PATCH 4.9 68/72] tracing: Use SOFTIRQ_OFFSET for softirq dectection for more accurate results Greg Kroah-Hartman
2017-07-19 10:25 ` [PATCH 4.9 72/72] kvm: vmx: allow host to access guest MSR_IA32_BNDCFGS Greg Kroah-Hartman
2017-07-19 15:58 ` [PATCH 4.9 00/72] 4.9.39-stable review Sumit Semwal
2017-07-20 5:08 ` Greg Kroah-Hartman
2017-07-19 20:34 ` Guenter Roeck
2017-07-19 23:39 ` Shuah Khan
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20170719102440.711094456@linuxfoundation.org \
--to=gregkh@linuxfoundation.org \
--cc=linux-kernel@vger.kernel.org \
--cc=marc.zyngier@arm.com \
--cc=stable@vger.kernel.org \
--cc=suzuki.poulose@arm.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).