Repository files (latest commit first)

Filename	Latest commit message	Latest commit date
Alexander Lobakin b123049846 iommu/vt-d: avoid invalid memory access via node_online(NUMA_NO_NODE) ... commit b0b0b77ea611e3088e9523e60860f4f41b62b235 upstream. KASAN reports: [ 4.668325][ T0] BUG: KASAN: wild-memory-access in dmar_parse_one_rhsa (arch/x86/include/asm/bitops.h:214 arch/x86/include/asm/bitops.h:226 include/asm-generic/bitops/instrumented-non-atomic.h:142 include/linux/nodemask.h:415 drivers/iommu/intel/dmar.c:497) [ 4.676149][ T0] Read of size 8 at addr 1fffffff85115558 by task swapper/0/0 [ 4.683454][ T0] [ 4.685638][ T0] CPU: 0 PID: 0 Comm: swapper/0 Not tainted 5.19.0-rc3-00004-g0e862838f290 #1 [ 4.694331][ T0] Hardware name: Supermicro SYS-5018D-FN4T/X10SDV-8C-TLN4F, BIOS 1.1 03/02/2016 [ 4.703196][ T0] Call Trace: [ 4.706334][ T0] <TASK> [ 4.709133][ T0] ? dmar_parse_one_rhsa (arch/x86/include/asm/bitops.h:214 arch/x86/include/asm/bitops.h:226 include/asm-generic/bitops/instrumented-non-atomic.h:142 include/linux/nodemask.h:415 drivers/iommu/intel/dmar.c:497) after converting the type of the first argument (@nr, bit number) of arch_test_bit() from `long` to `unsigned long`[0]. Under certain conditions (for example, when ACPI NUMA is disabled via command line), pxm_to_node() can return %NUMA_NO_NODE (-1). It is valid 'magic' number of NUMA node, but not valid bit number to use in bitops. node_online() eventually descends to test_bit() without checking for the input, assuming it's on caller side (which might be good for perf-critical tasks). There, -1 becomes %ULONG_MAX which leads to an insane array index when calculating bit position in memory. For now, add an explicit check for @node being not %NUMA_NO_NODE before calling test_bit(). The actual logics didn't change here at all. [0] 0e862838f2 Fixes: ee34b32d8c ("dmar: support for parsing Remapping Hardware Static Affinity structure") Cc: stable@vger.kernel.org # 2.6.33+ Reported-by: kernel test robot <oliver.sang@intel.com> Signed-off-by: Alexander Lobakin <alexandr.lobakin@intel.com> Reviewed-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com> Reviewed-by: Lu Baolu <baolu.lu@linux.intel.com> Signed-off-by: Yury Norov <yury.norov@gmail.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>		2022-08-25 11:18:15 +02:00
..
amd_iommu.c
amd_iommu.h
amd_iommu_debugfs.c
amd_iommu_init.c	iommu/amd: Increase timeout waiting for GA log enablement	2022-06-14 18:11:43 +02:00
amd_iommu_proto.h
amd_iommu_quirks.c
amd_iommu_types.h
amd_iommu_v2.c
arm-smmu-impl.c
arm-smmu-v3.c	iommu/arm-smmu-v3: fix event handling soft lockup	2022-04-15 14:18:33 +02:00
arm-smmu.c
arm-smmu.h
dma-iommu.c
dmar.c	iommu/vt-d: avoid invalid memory access via node_online(NUMA_NO_NODE)	2022-08-25 11:18:15 +02:00
exynos-iommu.c	iommu/exynos: Handle failed IOMMU device registration properly	2022-08-25 11:18:03 +02:00
fsl_pamu.c
fsl_pamu.h
fsl_pamu_domain.c
fsl_pamu_domain.h
hyperv-iommu.c
intel-iommu-debugfs.c
intel-iommu.c
intel-pasid.c
intel-pasid.h
intel-svm.c
intel-trace.c
intel_irq_remapping.c	iommu/vt-d: Fix potential memory leak in intel_setup_irq_remapping()	2022-02-08 18:24:29 +01:00
io-pgtable-arm-v7s.c
io-pgtable-arm.c
io-pgtable.c
iommu-debugfs.c
iommu-sysfs.c
iommu-traces.c
iommu.c
iova.c	iommu/iova: Improve 32-bit free space estimate	2022-04-15 14:17:56 +02:00
ipmmu-vmsa.c	iommu/ipmmu-vmsa: Check for error num after setting mask	2022-04-15 14:18:12 +02:00
irq_remapping.c
irq_remapping.h
Kconfig
Makefile
msm_iommu.c	iommu/msm: Fix an incorrect NULL check on list iterator	2022-06-14 18:11:48 +02:00
msm_iommu.h
msm_iommu_hw-8xxx.h
mtk_iommu.c	iommu/mediatek: Add list_del in mtk_iommu_remove	2022-06-14 18:11:43 +02:00
mtk_iommu.h
mtk_iommu_v1.c
of_iommu.c
omap-iommu-debug.c
omap-iommu.c
omap-iommu.h
omap-iopgtable.h
qcom_iommu.c	iommu/arm-smmu: qcom_iommu: Add of_node_put() when breaking out of loop	2022-08-25 11:18:04 +02:00
rockchip-iommu.c
s390-iommu.c
tegra-gart.c
tegra-smmu.c
virtio-iommu.c