MIME-Version: 1.0
References: <20230217131726.12666-1-alsp705@gmail.com>
In-Reply-To: <20230217131726.12666-1-alsp705@gmail.com>
From:   "Rafael J. Wysocki" <rafael@kernel.org>
Date:   Fri, 17 Mar 2023 18:45:48 +0100
Message-ID: <CAJZ5v0jsmshYESk2KX0SiUZKZTaNyrNqVy=GxMK4DkN3j6yPZw@mail.gmail.com>
Subject: Re: [PATCH] arch/x86/kernel/acpi/boot: fix buffer overflow on
 negative index in mp_config_acpi_gsi()
To:     Alexander Sapozhnikov <alsp705@gmail.com>
Cc:     "Rafael J. Wysocki" <rafael@kernel.org>,
        Len Brown <len.brown@intel.com>, Pavel Machek <pavel@ucw.cz>,
        Thomas Gleixner <tglx@linutronix.de>,
        Ingo Molnar <mingo@redhat.com>, Borislav Petkov <bp@alien8.de>,
        Dave Hansen <dave.hansen@linux.intel.com>, x86@kernel.org,
        "H. Peter Anvin" <hpa@zytor.com>, linux-pm@vger.kernel.org,
        linux-kernel@vger.kernel.org, lvc-project@linuxtesting.org
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: 8BIT
Precedence: bulk

On Fri, Feb 17, 2023 at 2:17 PM Alexander Sapozhnikov <alsp705@gmail.com> wrote:
>
> Variable 'ioapic', which may receive negative value by calling
> function 'mp_find_ioapic' at boot.c:465, is used at
> io_apic.c:128 by passing as 1st parameter to function 'mpc_ioapic_id'
> at boot.c:466

And that function uses the given value for array indexing without
checking it, right?

I would rather call this "out of bounds access"

> Found by Linux Verification Center (linuxtesting.org) with SVACE.
>
> Signed-off-by: Alexander Sapozhnikov <alsp705@gmail.com>
> ---
>  arch/x86/kernel/acpi/boot.c | 6 ++++--
>  1 file changed, 4 insertions(+), 2 deletions(-)
>
> diff --git a/arch/x86/kernel/acpi/boot.c b/arch/x86/kernel/acpi/boot.c
> index 907cc98b1938..abb78822f164 100644
> --- a/arch/x86/kernel/acpi/boot.c
> +++ b/arch/x86/kernel/acpi/boot.c
> @@ -463,8 +463,10 @@ static void mp_config_acpi_gsi(struct device *dev, u32 gsi, int trigger,
>         mp_irq.srcbus = number;
>         mp_irq.srcbusirq = (((devfn >> 3) & 0x1f) << 2) | ((pin - 1) & 3);
>         ioapic = mp_find_ioapic(gsi);
> -       mp_irq.dstapic = mpc_ioapic_id(ioapic);
> -       mp_irq.dstirq = mp_find_ioapic_pin(ioapic, gsi);
> +       if (ioapic >= 0) {
> +               mp_irq.dstapic = mpc_ioapic_id(ioapic);
> +               mp_irq.dstirq = mp_find_ioapic_pin(ioapic, gsi);
> +       }
>
>         mp_save_irq(&mp_irq);

Is it still valid to call this if ioapic is negative?

>  #endif
> --
> 2.34.1
>