linux-kernel - [tip:x86/apic] acpi: Fix broken error check in map

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <tip-c183a603e8d8a5a189729b77d0c623a3d5950e5f@git.kernel.org>
Date:   Fri, 23 Sep 2016 11:54:45 -0700
From:   tip-bot for Thomas Gleixner <tipbot@...or.com>
To:     linux-tip-commits@...r.kernel.org
Cc:     zhugh.fnst@...fujitsu.com, peterz@...radead.org,
        tglx@...utronix.de, tangchen@...fujitsu.com,
        torvalds@...ux-foundation.org, linux-kernel@...r.kernel.org,
        hpa@...or.com, mingo@...nel.org, guz.fnst@...fujitsu.com,
        douly.fnst@...fujitsu.com
Subject: [tip:x86/apic] acpi: Fix broken error check in map_processor()

Commit-ID:  c183a603e8d8a5a189729b77d0c623a3d5950e5f
Gitweb:     http://git.kernel.org/tip/c183a603e8d8a5a189729b77d0c623a3d5950e5f
Author:     Thomas Gleixner <tglx@...utronix.de>
AuthorDate: Fri, 23 Sep 2016 17:08:04 +0200
Committer:  Ingo Molnar <mingo@...nel.org>
CommitDate: Fri, 23 Sep 2016 18:04:56 +0200

acpi: Fix broken error check in map_processor()

map_processor() checks the cpuid value returned by acpi_map_cpuid() for -1
but acpi_map_cpuid() returns -EINVAL in case of error.

As a consequence the error is ignored and the following access into percpu
data with that negative cpuid results in a boot crash.

This happens always when NR_CPUS/nr_cpu_ids is smaller than the number of
processors listed in the ACPI tables.

Use a proper error check for id < 0 so the function returns instead of
trying to map CPU#(-EINVAL).

Reported-by: Ingo Molnar <mingo@...nel.org>
Signed-off-by: Thomas Gleixner <tglx@...utronix.de>
Cc: Dou Liyang <douly.fnst@...fujitsu.com>
Cc: Gu Zheng <guz.fnst@...fujitsu.com>
Cc: Linus Torvalds <torvalds@...ux-foundation.org>
Cc: Peter Zijlstra <peterz@...radead.org>
Cc: Tang Chen <tangchen@...fujitsu.com>
Cc: Zhu Guihua <zhugh.fnst@...fujitsu.com>
Cc: akpm@...ux-foundation.org
Cc: chen.tang@...ystack.cn
Cc: cl@...ux.com
Cc: gongzhaogang@...pur.com
Cc: isimatu.yasuaki@...fujitsu.com
Cc: izumi.taku@...fujitsu.com
Cc: kamezawa.hiroyu@...fujitsu.com
Cc: len.brown@...el.com
Cc: lenb@...nel.org
Cc: linux-acpi@...r.kernel.org
Cc: linux-mm@...ck.org
Cc: mika.j.penttila@...il.com
Cc: rafael@...nel.org
Cc: rjw@...ysocki.net
Cc: tj@...nel.org
Cc: yasu.isimatu@...il.com
Fixes: dc6db24d2476 ("x86/acpi: Set persistent cpuid <-> nodeid mapping when booting")
Link: http://lkml.kernel.org/r/alpine.DEB.2.20.1609231705570.5640@nanos
Signed-off-by: Ingo Molnar <mingo@...nel.org>
---
 drivers/acpi/processor_core.c | 9 +++++----
 1 file changed, 5 insertions(+), 4 deletions(-)

diff --git a/drivers/acpi/processor_core.c b/drivers/acpi/processor_core.c
index 9ac265f..5c78ee1 100644
--- a/drivers/acpi/processor_core.c
+++ b/drivers/acpi/processor_core.c
@@ -284,7 +284,7 @@ EXPORT_SYMBOL_GPL(acpi_get_cpuid);
 static bool __init
 map_processor(acpi_handle handle, phys_cpuid_t *phys_id, int *cpuid)
 {
-	int type;
+	int type, id;
 	u32 acpi_id;
 	acpi_status status;
 	acpi_object_type acpi_type;
@@ -320,10 +320,11 @@ map_processor(acpi_handle handle, phys_cpuid_t *phys_id, int *cpuid)
 	type = (acpi_type == ACPI_TYPE_DEVICE) ? 1 : 0;
 
 	*phys_id = __acpi_get_phys_id(handle, type, acpi_id, false);
-	*cpuid = acpi_map_cpuid(*phys_id, acpi_id);
-	if (*cpuid == -1)
-		return false;
+	id = acpi_map_cpuid(*phys_id, acpi_id);
 
+	if (id < 0)
+		return false;
+	*cpuid = id;
 	return true;
 }