Skip to contentSkip to conversation

arch/x86/kernel/acpi/boot: fix buffer overflow on negative index in mp_config_acpi_gsi()

PATCH In review Alexander Sapozhnikov 2 participants 2 messages Feb 17, 2023 – Mar 17, 2023

Subsystems (2)
x86 ACPI
lore
Share & tools
lore

Alexander Sapozhnikov

author
#0 lore raw

PATCH 1/1 arch/x86/kernel/acpi/boot: fix buffer overflow on negative index in mp_config_acpi_gsi()

Variable 'ioapic', which may receive negative value by calling function 'mp_find_ioapic' at boot.c:465, is used at io_apic.c:128 by passing as 1st parameter to function 'mpc_ioapic_id' at boot.c:466

Found by Linux Verification Center (linuxtesting.org) with SVACE.

Signed-off-by Alexander Sapozhnikov <[email protected]>
---
 arch/x86/kernel/acpi/boot.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)
arch/x86/kernel/acpi/boot.c +4 -2
index 907cc98b1938..abb78822f164 100644
@@ -463,8 +463,10 @@ static void mp_config_acpi_gsi(struct device *dev, u32 gsi, int trigger,
 	mp_irq.srcbus = number;
 	mp_irq.srcbusirq = (((devfn >> 3) & 0x1f) << 2) | ((pin - 1) & 3);
 	ioapic = mp_find_ioapic(gsi);
-	mp_irq.dstapic = mpc_ioapic_id(ioapic);
-	mp_irq.dstirq = mp_find_ioapic_pin(ioapic, gsi);
+	if (ioapic >= 0) {
+		mp_irq.dstapic = mpc_ioapic_id(ioapic);
+		mp_irq.dstirq = mp_find_ioapic_pin(ioapic, gsi);
+	}
 
 	mp_save_irq(&mp_irq);
 #endif
Signature · 1 line
2.34.1
maintainer
#1 lore raw
Quoted 5 lines · Alexander Sapozhnikov

Variable 'ioapic', which may receive negative value by calling function 'mp_find_ioapic' at boot.c:465, is used at io_apic.c:128 by passing as 1st parameter to function 'mpc_ioapic_id' at boot.c:466

And that function uses the given value for array indexing without checking it, right?

I would rather call this "out of bounds access"

Quoted 13 lines

Found by Linux Verification Center (linuxtesting.org) with SVACE.

Signed-off-by Alexander Sapozhnikov <[email protected]>
---
 arch/x86/kernel/acpi/boot.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)
arch/x86/kernel/acpi/boot.c +0 -0
index 907cc98b1938..abb78822f164 100644
@@ -463,8 +463,10 @@ static void mp_config_acpi_gsi(struct device *dev, u32 gsi, int trigger,
        mp_irq.srcbus = number;

arch/x86/kernel/acpi/boot.c static void mp_config_acpi_gsi(struct device *dev, u32 gsi, int trigger, · line 471

Quoted 10 lines
arch/x86/kernel/acpi/boot.c +4 -2
        mp_irq.srcbusirq = (((devfn >> 3) & 0x1f) << 2) | ((pin - 1) & 3);
        ioapic = mp_find_ioapic(gsi);
-       mp_irq.dstapic = mpc_ioapic_id(ioapic);
-       mp_irq.dstirq = mp_find_ioapic_pin(ioapic, gsi);
+       if (ioapic >= 0) {
+               mp_irq.dstapic = mpc_ioapic_id(ioapic);
+               mp_irq.dstirq = mp_find_ioapic_pin(ioapic, gsi);
+       }
 
        mp_save_irq(&mp_irq);

Is it still valid to call this if ioapic is negative?

Quoted 4 lines
arch/x86/kernel/acpi/boot.c +0 -1
 #endif
--

2.34.1