2023-02-17 13:17:42

by Alexander Sapozhnikov

Subject: [PATCH] arch/x86/kernel/acpi/boot: fix buffer overflow on negative index in mp_config_acpi_gsi()

Variable 'ioapic', which may receive negative value by calling
function 'mp_find_ioapic' at boot.c:465, is used at
io_apic.c:128 by passing as 1st parameter to function 'mpc_ioapic_id'
at boot.c:466

Found by Linux Verification Center (linuxtesting.org) with SVACE.

Signed-off-by: Alexander Sapozhnikov <[email protected]>
---
arch/x86/kernel/acpi/boot.c | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/arch/x86/kernel/acpi/boot.c b/arch/x86/kernel/acpi/boot.c
index 907cc98b1938..abb78822f164 100644
--- a/arch/x86/kernel/acpi/boot.c
+++ b/arch/x86/kernel/acpi/boot.c
@@ -463,8 +463,10 @@ static void mp_config_acpi_gsi(struct device *dev, u32 gsi, int trigger,
mp_irq.srcbus = number;
mp_irq.srcbusirq = (((devfn >> 3) & 0x1f) << 2) | ((pin - 1) & 3);
ioapic = mp_find_ioapic(gsi);
- mp_irq.dstapic = mpc_ioapic_id(ioapic);
- mp_irq.dstirq = mp_find_ioapic_pin(ioapic, gsi);
+ if (ioapic >= 0) {
+ mp_irq.dstapic = mpc_ioapic_id(ioapic);
+ mp_irq.dstirq = mp_find_ioapic_pin(ioapic, gsi);
+ }

mp_save_irq(&mp_irq);
#endif
--
2.34.1

2023-03-17 17:46:07

by Rafael J. Wysocki

Subject: Re: [PATCH] arch/x86/kernel/acpi/boot: fix buffer overflow on negative index in mp_config_acpi_gsi()

On Fri, Feb 17, 2023 at 2:17 PM Alexander Sapozhnikov <[email protected]> wrote:
>
> Variable 'ioapic', which may receive negative value by calling
> function 'mp_find_ioapic' at boot.c:465, is used at
> io_apic.c:128 by passing as 1st parameter to function 'mpc_ioapic_id'
> at boot.c:466

And that function uses the given value for array indexing without
checking it, right?

I would rather call this "out of bounds access"

> Found by Linux Verification Center (linuxtesting.org) with SVACE.
>
> Signed-off-by: Alexander Sapozhnikov <[email protected]>
> ---
> arch/x86/kernel/acpi/boot.c | 6 ++++--
> 1 file changed, 4 insertions(+), 2 deletions(-)
>
> diff --git a/arch/x86/kernel/acpi/boot.c b/arch/x86/kernel/acpi/boot.c
> index 907cc98b1938..abb78822f164 100644
> --- a/arch/x86/kernel/acpi/boot.c
> +++ b/arch/x86/kernel/acpi/boot.c
> @@ -463,8 +463,10 @@ static void mp_config_acpi_gsi(struct device *dev, u32 gsi, int trigger,
> mp_irq.srcbus = number;
> mp_irq.srcbusirq = (((devfn >> 3) & 0x1f) << 2) | ((pin - 1) & 3);
> ioapic = mp_find_ioapic(gsi);
> - mp_irq.dstapic = mpc_ioapic_id(ioapic);
> - mp_irq.dstirq = mp_find_ioapic_pin(ioapic, gsi);
> + if (ioapic >= 0) {
> + mp_irq.dstapic = mpc_ioapic_id(ioapic);
> + mp_irq.dstirq = mp_find_ioapic_pin(ioapic, gsi);
> + }
>
> mp_save_irq(&mp_irq);

Is it still valid to call this if ioapic is negative?

> #endif
> --
> 2.34.1
>