[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Stable-7.2.11 22/41] hmat acpi: Fix out of bounds access due to missing
From: |
Michael Tokarev |
Subject: |
[Stable-7.2.11 22/41] hmat acpi: Fix out of bounds access due to missing use of indirection |
Date: |
Wed, 10 Apr 2024 08:43:43 +0300 |
From: Jonathan Cameron <Jonathan.Cameron@huawei.com>
With a numa set up such as
-numa nodeid=0,cpus=0 \
-numa nodeid=1,memdev=mem \
-numa nodeid=2,cpus=1
and appropriate hmat_lb entries the initiator list is correctly
computed and writen to HMAT as 0,2 but then the LB data is accessed
using the node id (here 2), landing outside the entry_list array.
Stash the reverse lookup when writing the initiator list and use
it to get the correct array index index.
Fixes: 4586a2cb83 ("hmat acpi: Build System Locality Latency and Bandwidth
Information Structure(s)")
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Message-Id: <20240307160326.31570-3-Jonathan.Cameron@huawei.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
(cherry picked from commit 74e2845c5f95b0c139c79233ddb65bb17f2dd679)
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
diff --git a/hw/acpi/hmat.c b/hw/acpi/hmat.c
index 3a6d51282a..768038e0da 100644
--- a/hw/acpi/hmat.c
+++ b/hw/acpi/hmat.c
@@ -77,6 +77,7 @@ static void build_hmat_lb(GArray *table_data, HMAT_LB_Info
*hmat_lb,
uint32_t *initiator_list)
{
int i, index;
+ uint32_t initiator_to_index[MAX_NODES] = {};
HMAT_LB_Data *lb_data;
uint16_t *entry_list;
uint32_t base;
@@ -120,6 +121,8 @@ static void build_hmat_lb(GArray *table_data, HMAT_LB_Info
*hmat_lb,
/* Initiator Proximity Domain List */
for (i = 0; i < num_initiator; i++) {
build_append_int_noprefix(table_data, initiator_list[i], 4);
+ /* Reverse mapping for array possitions */
+ initiator_to_index[initiator_list[i]] = i;
}
/* Target Proximity Domain List */
@@ -131,7 +134,8 @@ static void build_hmat_lb(GArray *table_data, HMAT_LB_Info
*hmat_lb,
entry_list = g_new0(uint16_t, num_initiator * num_target);
for (i = 0; i < hmat_lb->list->len; i++) {
lb_data = &g_array_index(hmat_lb->list, HMAT_LB_Data, i);
- index = lb_data->initiator * num_target + lb_data->target;
+ index = initiator_to_index[lb_data->initiator] * num_target +
+ lb_data->target;
entry_list[index] = (uint16_t)(lb_data->data / hmat_lb->base);
}
--
2.39.2
- [Stable-7.2.11 11/41] make-release: switch to .xz format by default, (continued)
- [Stable-7.2.11 11/41] make-release: switch to .xz format by default, Michael Tokarev, 2024/04/10
- [Stable-7.2.11 12/41] e1000e: fix link state on resume, Michael Tokarev, 2024/04/10
- [Stable-7.2.11 16/41] hw/nvme: separate 'serial' property for VFs, Michael Tokarev, 2024/04/10
- [Stable-7.2.11 17/41] hw/nvme: generalize the mbar size helper, Michael Tokarev, 2024/04/10
- [Stable-7.2.11 19/41] pcie: Introduce pcie_sriov_num_vfs, Michael Tokarev, 2024/04/10
- [Stable-7.2.11 18/41] hw/nvme: add machine compatibility parameter to enable msix exclusive bar, Michael Tokarev, 2024/04/10
- [Stable-7.2.11 20/41] hw/nvme: Use pcie_sriov_num_vfs(), Michael Tokarev, 2024/04/10
- [Stable-7.2.11 21/41] pcie_sriov: Validate NumVFs, Michael Tokarev, 2024/04/10
- [Stable-7.2.11 14/41] hw/nvme: clean up confusing use of errp/local_err, Michael Tokarev, 2024/04/10
- [Stable-7.2.11 15/41] hw/nvme: cleanup error reporting in nvme_init_pci(), Michael Tokarev, 2024/04/10
- [Stable-7.2.11 22/41] hmat acpi: Fix out of bounds access due to missing use of indirection,
Michael Tokarev <=
- [Stable-7.2.11 24/41] tests/unit: Bump test-aio-multithread test timeout to 2 minutes, Michael Tokarev, 2024/04/10
- [Stable-7.2.11 26/41] tests/unit: Bump test-replication timeout to 60 seconds, Michael Tokarev, 2024/04/10
- [Stable-7.2.11 25/41] tests/unit: Bump test-crypto-block test timeout to 5 minutes, Michael Tokarev, 2024/04/10
- [Stable-7.2.11 23/41] migration: Skip only empty block devices, Michael Tokarev, 2024/04/10
- [Stable-7.2.11 27/41] tests: Raise timeouts for bufferiszero and crypto-tlscredsx509, Michael Tokarev, 2024/04/10
- [Stable-7.2.11 29/41] target/i386: use separate MMU indexes for 32-bit accesses, Michael Tokarev, 2024/04/10
- [Stable-7.2.11 30/41] target/i386: fix direction of "32-bit MMU" test, Michael Tokarev, 2024/04/10
- [Stable-7.2.11 33/41] hw/scsi/scsi-generic: Fix io_timeout property not applying, Michael Tokarev, 2024/04/10
- [Stable-7.2.11 32/41] target/loongarch: Fix qemu-system-loongarch64 assert failed with the option '-d int', Michael Tokarev, 2024/04/10
- [Stable-7.2.11 28/41] target/i386: introduce function to query MMU indices, Michael Tokarev, 2024/04/10