We compare the size in bytes of a struct (and its ending flexible array)
with the number of elements in a flexible array.
This is wrong and "ir->size < ir->used" is likely to be always false.
Compute the number of possible entries instead, as already done in other
places, and compare it to the number of used entries.
Fixes: b584db0c84db ("x86/PCI: Add $IRT PIRQ routing table support")
Signed-off-by: Christophe JAILLET <[email protected]>
---
/!\ This patch is speculative. Review with care /!\
I'm not sure that this sanity check is needed at all.
If 'used' was the size of the flexible array, I think it would simplify
the code in other places. It will also help scripts when __counted_by macro
will be added.
See [1].
[1]: https://lore.kernel.org/all/[email protected]/
---
arch/x86/pci/irq.c | 6 +++++-
1 file changed, 5 insertions(+), 1 deletion(-)
diff --git a/arch/x86/pci/irq.c b/arch/x86/pci/irq.c
index a498b847d740..e29b487cc069 100644
--- a/arch/x86/pci/irq.c
+++ b/arch/x86/pci/irq.c
@@ -128,12 +128,16 @@ static inline struct irq_routing_table *pirq_convert_irt_table(u8 *addr,
{
struct irt_routing_table *ir;
struct irq_routing_table *rt;
+ int entries;
u16 size;
u8 sum;
int i;
ir = (struct irt_routing_table *)addr;
- if (ir->signature != IRT_SIGNATURE || !ir->used || ir->size < ir->used)
+ entries = (ir->size - sizeof(struct irq_routing_table)) /
+ sizeof(struct irq_info);
+
+ if (ir->signature != IRT_SIGNATURE || !ir->used || entries < ir->used)
return NULL;
size = sizeof(*ir) + ir->used * sizeof(ir->slots[0]);
--
2.34.1
'size' if computed twice. *ir and *it being the same, the result is the
same as well.
While at it, also use struct_size() which is less verbose, more robust and
more informative.
Signed-off-by: Christophe JAILLET <[email protected]>
---
arch/x86/pci/irq.c | 3 +--
1 file changed, 1 insertion(+), 2 deletions(-)
diff --git a/arch/x86/pci/irq.c b/arch/x86/pci/irq.c
index e29b487cc069..6bc51f80eec2 100644
--- a/arch/x86/pci/irq.c
+++ b/arch/x86/pci/irq.c
@@ -140,14 +140,13 @@ static inline struct irq_routing_table *pirq_convert_irt_table(u8 *addr,
if (ir->signature != IRT_SIGNATURE || !ir->used || entries < ir->used)
return NULL;
- size = sizeof(*ir) + ir->used * sizeof(ir->slots[0]);
+ size = struct_size(ir, slots, ir->used);
if (size > limit - addr)
return NULL;
DBG(KERN_DEBUG "PCI: $IRT Interrupt Routing Table found at 0x%lx\n",
__pa(ir));
- size = sizeof(*rt) + ir->used * sizeof(rt->slots[0]);
rt = kzalloc(size, GFP_KERNEL);
if (!rt)
return NULL;
--
2.34.1
On Sat, 6 May 2023, Christophe JAILLET wrote:
> We compare the size in bytes of a struct (and its ending flexible array)
> with the number of elements in a flexible array.
Incorrect, see the inline documentation for the struct.
> This is wrong and "ir->size < ir->used" is likely to be always false.
Hopefully, but we've seen all kinds of rubbish in PC BIOS data, and this
data structure seems available for OEMs to program with a tool called BCP.
Better safe than sorry. Therefore, NAK.
Maciej
On Sat, 6 May 2023, Christophe JAILLET wrote:
> 'size' if computed twice. *ir and *it being the same, the result is the
> same as well.
There is no `it' data object in this function; I presume you meant `rt'.
Then `*ir' and `*rt' are of a different type each, hence the calculations
are not the same. If they were the same, the function wouldn't be needed
at all in the first place. Therefore, NAK.
> While at it, also use struct_size() which is less verbose, more robust and
> more informative.
This might be a valuable clean-up, thank you, please submit separately.
Maciej
Le 19/05/2023 à 13:21, Maciej W. Rozycki a écrit :
> On Sat, 6 May 2023, Christophe JAILLET wrote:
>
>> We compare the size in bytes of a struct (and its ending flexible array)
>> with the number of elements in a flexible array.
>
> Incorrect, see the inline documentation for the struct.
Ouch.
As you explained in your reply for the 2nd patch:
irT_routing_table != irQ_routing_table
Sorry for the noise.
CJ
>
>> This is wrong and "ir->size < ir->used" is likely to be always false.
>
> Hopefully, but we've seen all kinds of rubbish in PC BIOS data, and this
> data structure seems available for OEMs to program with a tool called BCP.
> Better safe than sorry. Therefore, NAK.
>
> Maciej
>