Suzuki K Poulose 866d7c1b0a irqchip/gic-v3: Fix out-of-bound access in gic_set_affinity ... The GICv3 driver doesn't check if the target CPU for gic_set_affinity is valid before going ahead and making the changes. This triggers the following splat with KASAN: [ 141.189434] BUG: KASAN: global-out-of-bounds in gic_set_affinity+0x8c/0x140 [ 141.189704] Read of size 8 at addr ffff200009741d20 by task swapper/1/0 [ 141.189958] [ 141.190158] CPU: 1 PID: 0 Comm: swapper/1 Not tainted 4.12.0-rc7 [ 141.190458] Hardware name: Foundation-v8A (DT) [ 141.190658] Call trace: [ 141.190908] [<ffff200008089d70>] dump_backtrace+0x0/0x328 [ 141.191224] [<ffff20000808a1b4>] show_stack+0x14/0x20 [ 141.191507] [<ffff200008504c3c>] dump_stack+0xa4/0xc8 [ 141.191858] [<ffff20000826c19c>] print_address_description+0x13c/0x250 [ 141.192219] [<ffff20000826c5c8>] kasan_report+0x210/0x300 [ 141.192547] [<ffff20000826ad54>] __asan_load8+0x84/0x98 [ 141.192874] [<ffff20000854eeec>] gic_set_affinity+0x8c/0x140 [ 141.193158] [<ffff200008148b14>] irq_do_set_affinity+0x54/0xb8 [ 141.193473] [<ffff200008148d2c>] irq_set_affinity_locked+0x64/0xf0 [ 141.193828] [<ffff200008148e00>] __irq_set_affinity+0x48/0x78 [ 141.194158] [<ffff200008bc48a4>] arm_perf_starting_cpu+0x104/0x150 [ 141.194513] [<ffff2000080d73bc>] cpuhp_invoke_callback+0x17c/0x1f8 [ 141.194783] [<ffff2000080d94ec>] notify_cpu_starting+0x8c/0xb8 [ 141.195130] [<ffff2000080911ec>] secondary_start_kernel+0x15c/0x200 [ 141.195390] [<0000000080db81b4>] 0x80db81b4 [ 141.195603] [ 141.195685] The buggy address belongs to the variable: [ 141.196012] __cpu_logical_map+0x200/0x220 [ 141.196176] [ 141.196315] Memory state around the buggy address: [ 141.196586] ffff200009741c00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 141.196913] ffff200009741c80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 141.197158] >ffff200009741d00: 00 00 00 00 fa fa fa fa 00 00 00 00 00 00 00 00 [ 141.197487] ^ [ 141.197758] ffff200009741d80: 00 00 00 00 00 00 00 00 fa fa fa fa 00 00 00 00 [ 141.198060] ffff200009741e00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 141.198358] ================================================================== [ 141.198609] Disabling lock debugging due to kernel taint [ 141.198961] CPU1: Booted secondary processor [410fd051] This patch adds the check to make sure the cpu is valid. Fixes: commit 021f653791 ("irqchip: gic-v3: Initial support for GICv3") Cc: stable@vger.kernel.org Signed-off-by: Suzuki K Poulose <suzuki.poulose@arm.com> Signed-off-by: Marc Zyngier <marc.zyngier@arm.com>		2017-06-30 15:32:17 +01:00
..
alphascale_asm9260-icoll.h
exynos-combiner.c
irq-alpine-msi.c
irq-armada-370-xp.c	Revert "irqchip/armada-370-xp: Fix regression by clearing IRQ_NOAUTOEN"	2017-06-22 14:13:33 +01:00
irq-aspeed-i2c-ic.c	irqchip/aspeed-i2c-ic: Add I2C IRQ controller for Aspeed	2017-06-22 14:15:00 +01:00
irq-aspeed-vic.c	irqchip/aspeed-vic: Add AST2500 compatible string	2017-06-22 14:13:39 +01:00
irq-ath79-cpu.c
irq-ath79-misc.c
irq-atmel-aic-common.c
irq-atmel-aic-common.h
irq-atmel-aic.c
irq-atmel-aic5.c
irq-bcm2835.c
irq-bcm2836.c
irq-bcm6345-l1.c
irq-bcm7038-l1.c
irq-bcm7120-l2.c
irq-brcmstb-l2.c
irq-clps711x.c
irq-crossbar.c
irq-digicolor.c
irq-dw-apb-ictl.c
irq-eznps.c
irq-ftintc010.c
irq-gic-common.c
irq-gic-common.h
irq-gic-pm.c
irq-gic-realview.c
irq-gic-v2m.c
irq-gic-v3-its-pci-msi.c	irqchip/gic-v3-its: Fix MSI alias accounting	2017-06-22 14:13:26 +01:00
irq-gic-v3-its-platform-msi.c	irqchip/gic-v3-its-platform-msi: Make of_device_ids const	2017-06-23 09:14:58 +01:00
irq-gic-v3-its.c	irqchip/gic-v3-its: Don't assume GICv3 hardware supports 16bit INTID	2017-06-23 09:14:59 +01:00
irq-gic-v3.c	irqchip/gic-v3: Fix out-of-bound access in gic_set_affinity	2017-06-30 15:32:17 +01:00
irq-gic.c
irq-hip04.c
irq-i8259.c	irqchip/i8259: Constify irq_domain_ops	2017-06-22 14:12:49 +01:00
irq-imgpdc.c
irq-imx-gpcv2.c	irqchip/irq-imx-gpcv2: Constify irq_domain_ops	2017-06-22 14:12:55 +01:00
irq-ingenic.c
irq-jcore-aic.c
irq-keystone.c
irq-lpc32xx.c
irq-ls-scfg-msi.c
irq-mbigen.c	irqchip/irq-mbigen: Constify irq_domain_ops	2017-06-22 14:13:00 +01:00
irq-metag-ext.c
irq-metag.c
irq-mips-cpu.c
irq-mips-gic.c	irqchip/irq-mips-gic: Constify irq_domain_ops	2017-06-22 14:13:07 +01:00
irq-mmp.c
irq-mtk-cirq.c
irq-mtk-sysirq.c
irq-mvebu-gicp.c	irqchip/irq-mvebu-gicp: Add new driver for Marvell GICP	2017-06-23 09:14:57 +01:00
irq-mvebu-gicp.h	irqchip/irq-mvebu-gicp: Add new driver for Marvell GICP	2017-06-23 09:14:57 +01:00
irq-mvebu-icu.c	irqchip/irq-mvebu-icu: Add new driver for Marvell ICU	2017-06-23 09:14:57 +01:00
irq-mvebu-odmi.c
irq-mvebu-pic.c
irq-mxs.c
irq-nvic.c
irq-omap-intc.c
irq-or1k-pic.c
irq-orion.c
irq-partition-percpu.c
irq-pic32-evic.c
irq-renesas-h8s.c	irqchip/irq-renesas-h8s: Constify irq_domain_ops	2017-06-22 14:13:20 +01:00
irq-renesas-h8300h.c	irqchip/irq-renesas-h8300h: Constify irq_domain_ops	2017-06-22 14:13:14 +01:00
irq-renesas-intc-irqpin.c
irq-renesas-irqc.c
irq-s3c24xx.c
irq-sa11x0.c
irq-sirfsoc.c
irq-st.c
irq-stm32-exti.c
irq-sun4i.c
irq-sunxi-nmi.c	irqchip/sunxi-nmi: Support sun6i-a31-r-intc compatible	2017-06-22 14:08:17 +01:00
irq-tango.c
irq-tb10x.c
irq-tegra.c
irq-ts4800.c
irq-versatile-fpga.c
irq-vf610-mscm-ir.c
irq-vic.c
irq-vt8500.c
irq-xilinx-intc.c
irq-xtensa-mx.c
irq-xtensa-pic.c
irq-zevio.c
irqchip.c
Kconfig	irqchip/irq-mvebu-icu: Add new driver for Marvell ICU	2017-06-23 09:14:57 +01:00
Makefile	irqchip/irq-mvebu-icu: Add new driver for Marvell ICU	2017-06-23 09:14:57 +01:00
qcom-irq-combiner.c	irqchip/qcom: Use builtin_platform_driver to simplify the code	2017-06-22 14:15:00 +01:00
spear-shirq.c