2023-09-14 23:57:05

by Wilczynski, Michal

Subject: [PATCH v1] ACPI: processor_pdc: Fix uninitialized access of buf

Bug was introduced during unification of setting CAP_SMP_T_SWCOORD for
_PDC and _OSC methods. Third u32 in buffer is never being zero-ed before
setting bits on it. The memory is not guaranteed to be zero as it was
allocated by kmalloc() instead of kzalloc(). Fix this by initializing
third u32 in buffer to 0.

Fixes: b9e8d0168a7a ("ACPI: processor: Set CAP_SMP_T_SWCOORD in arch_acpi_set_proc_cap_bits()")
Signed-off-by: Michal Wilczynski <[email protected]>
---
drivers/acpi/processor_pdc.c | 1 +
1 file changed, 1 insertion(+)

diff --git a/drivers/acpi/processor_pdc.c b/drivers/acpi/processor_pdc.c
index 1a8591e9a9bf..994091bd52de 100644
--- a/drivers/acpi/processor_pdc.c
+++ b/drivers/acpi/processor_pdc.c
@@ -19,6 +19,7 @@ static void acpi_set_pdc_bits(u32 *buf)
{
buf[0] = ACPI_PDC_REVISION_ID;
buf[1] = 1;
+ buf[2] = 0;

/* Twiddle arch-specific bits needed for _PDC */
arch_acpi_set_proc_cap_bits(&buf[2]);
--
2.41.0

2023-09-18 10:42:01

by Rafael J. Wysocki

Subject: Re: [PATCH v1] ACPI: processor_pdc: Fix uninitialized access of buf

On Fri, Sep 15, 2023 at 12:25 AM Michal Wilczynski
<[email protected]> wrote:
>
> Bug was introduced during unification of setting CAP_SMP_T_SWCOORD for
> _PDC and _OSC methods. Third u32 in buffer is never being zero-ed before
> setting bits on it. The memory is not guaranteed to be zero as it was
> allocated by kmalloc() instead of kzalloc(). Fix this by initializing
> third u32 in buffer to 0.
>
> Fixes: b9e8d0168a7a ("ACPI: processor: Set CAP_SMP_T_SWCOORD in arch_acpi_set_proc_cap_bits()")
> Signed-off-by: Michal Wilczynski <[email protected]>
> ---
> drivers/acpi/processor_pdc.c | 1 +
> 1 file changed, 1 insertion(+)
>
> diff --git a/drivers/acpi/processor_pdc.c b/drivers/acpi/processor_pdc.c
> index 1a8591e9a9bf..994091bd52de 100644
> --- a/drivers/acpi/processor_pdc.c
> +++ b/drivers/acpi/processor_pdc.c
> @@ -19,6 +19,7 @@ static void acpi_set_pdc_bits(u32 *buf)
> {
> buf[0] = ACPI_PDC_REVISION_ID;
> buf[1] = 1;
> + buf[2] = 0;
>
> /* Twiddle arch-specific bits needed for _PDC */
> arch_acpi_set_proc_cap_bits(&buf[2]);
> --

Applied as 6.6-rc material, thanks!