linux-kernel - Re: acpi: Fix broken error check in map

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <CAJZ5v0iCo=23ZC5G9gBY01VxY4PpJEbQsjdfZk1fC7bVR++M8w@mail.gmail.com>
Date:   Sat, 24 Sep 2016 02:06:36 +0200
From:   "Rafael J. Wysocki" <rafael@...nel.org>
To:     Thomas Gleixner <tglx@...utronix.de>
Cc:     Dou Liyang <douly.fnst@...fujitsu.com>, cl@...ux.com,
        Tejun Heo <tj@...nel.org>, mika.j.penttila@...il.com,
        Ingo Molnar <mingo@...hat.com>,
        Andrew Morton <akpm@...ux-foundation.org>,
        "Rafael J. Wysocki" <rjw@...ysocki.net>,
        "H. Peter Anvin" <hpa@...or.com>, yasu.isimatu@...il.com,
        isimatu.yasuaki@...fujitsu.com, kamezawa.hiroyu@...fujitsu.com,
        izumi.taku@...fujitsu.com, gongzhaogang@...pur.com,
        Len Brown <len.brown@...el.com>, Len Brown <lenb@...nel.org>,
        chen.tang@...ystack.cn, "Rafael J. Wysocki" <rafael@...nel.org>,
        "the arch/x86 maintainers" <x86@...nel.org>,
        ACPI Devel Maling List <linux-acpi@...r.kernel.org>,
        Linux Kernel Mailing List <linux-kernel@...r.kernel.org>,
        Linux Memory Management List <linux-mm@...ck.org>,
        Gu Zheng <guz.fnst@...fujitsu.com>,
        Tang Chen <tangchen@...fujitsu.com>,
        Zhu Guihua <zhugh.fnst@...fujitsu.com>
Subject: Re: acpi: Fix broken error check in map_processor()

On Fri, Sep 23, 2016 at 5:08 PM, Thomas Gleixner <tglx@...utronix.de> wrote:
> map_processor() checks the cpuid value returned by acpi_map_cpuid() for -1
> but acpi_map_cpuid() returns -EINVAL in case of error.
>
> As a consequence the error is ignored and the following access into percpu
> data with that negative cpuid results in a boot crash.
>
> This happens always when NR_CPUS/nr_cpu_ids is smaller than the number of
> processors listed in the ACPI tables.
>
> Use a proper error check for id < 0 so the function returns instead of
> trying to map CPU#(-EINVAL).
>
> Reported-by: Ingo Molnar <mingo@...nel.org>
> Fixes: dc6db24d2476 ("x86/acpi: Set persistent cpuid <-> nodeid mapping when booting")
> Signed-off-by: Thomas Gleixner <tglx@...utronix.de>

It looks like the commit in the Fixes tag is in the tip tree now, so
the fix should better go in via tip as well IMO.

Acked-by: Rafael J. Wysocki <rafael.j.wysocki@...el.com>

> ---
>  drivers/acpi/processor_core.c |    9 +++++----
>  1 file changed, 5 insertions(+), 4 deletions(-)
>
> --- a/drivers/acpi/processor_core.c
> +++ b/drivers/acpi/processor_core.c
> @@ -284,7 +284,7 @@ EXPORT_SYMBOL_GPL(acpi_get_cpuid);
>  static bool __init
>  map_processor(acpi_handle handle, phys_cpuid_t *phys_id, int *cpuid)
>  {
> -       int type;
> +       int type, id;
>         u32 acpi_id;
>         acpi_status status;
>         acpi_object_type acpi_type;
> @@ -320,10 +320,11 @@ map_processor(acpi_handle handle, phys_c
>         type = (acpi_type == ACPI_TYPE_DEVICE) ? 1 : 0;
>
>         *phys_id = __acpi_get_phys_id(handle, type, acpi_id, false);
> -       *cpuid = acpi_map_cpuid(*phys_id, acpi_id);
> -       if (*cpuid == -1)
> -               return false;
> +       id = acpi_map_cpuid(*phys_id, acpi_id);
>
> +       if (id < 0)
> +               return false;
> +       *cpuid = id;
>         return true;
>  }
>