From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S946262AbdDTOHP (ORCPT ); Thu, 20 Apr 2017 10:07:15 -0400 Received: from terminus.zytor.com ([65.50.211.136]:54883 "EHLO terminus.zytor.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S946224AbdDTOHL (ORCPT ); Thu, 20 Apr 2017 10:07:11 -0400 Date: Thu, 20 Apr 2017 07:04:58 -0700 From: tip-bot for Vikas Shivappa Message-ID: Cc: vikas.shivappa@linux.intel.com, sai.praneeth.prakhya@intel.com, hpa@zytor.com, linux-kernel@vger.kernel.org, tglx@linutronix.de, mingo@kernel.org Reply-To: hpa@zytor.com, sai.praneeth.prakhya@intel.com, vikas.shivappa@linux.intel.com, mingo@kernel.org, tglx@linutronix.de, linux-kernel@vger.kernel.org In-Reply-To: <1492645804-17465-4-git-send-email-vikas.shivappa@linux.intel.com> References: <1492645804-17465-4-git-send-email-vikas.shivappa@linux.intel.com> To: linux-tip-commits@vger.kernel.org Subject: [tip:x86/cpu] x86/intel_rdt: Return error for incorrect resource names in schemata Git-Commit-ID: 4797b7dfdfcf457075c36743d71e2b0feeaaa20f X-Mailer: tip-git-log-daemon Robot-ID: Robot-Unsubscribe: Contact to get blacklisted from these emails MIME-Version: 1.0 Content-Transfer-Encoding: 8bit Content-Type: text/plain; charset=UTF-8 Content-Disposition: inline Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Commit-ID: 4797b7dfdfcf457075c36743d71e2b0feeaaa20f Gitweb: http://git.kernel.org/tip/4797b7dfdfcf457075c36743d71e2b0feeaaa20f Author: Vikas Shivappa AuthorDate: Wed, 19 Apr 2017 16:50:04 -0700 Committer: Thomas Gleixner CommitDate: Thu, 20 Apr 2017 15:57:59 +0200 x86/intel_rdt: Return error for incorrect resource names in schemata When schemata parses the resource names it does not return an error if it detects incorrect resource names and fails quietly. This happens because for_each_enabled_rdt_resource(r) leaves "r" pointing beyond the end of the rdt_resources_all[] array, and the check for !r->name results in an out of bounds access. Split the resource parsing part into a helper function to avoid the issue. [ tglx: Made it readable by splitting the parser loop out into a function ] Reported-by: Prakhya, Sai Praneeth Signed-off-by: Vikas Shivappa Tested-by: Prakhya, Sai Praneeth Cc: fenghua.yu@intel.com Cc: tony.luck@intel.com Cc: ravi.v.shankar@intel.com Cc: vikas.shivappa@intel.com Link: http://lkml.kernel.org/r/1492645804-17465-4-git-send-email-vikas.shivappa@linux.intel.com Signed-off-by: Thomas Gleixner --- arch/x86/kernel/cpu/intel_rdt_schemata.c | 28 +++++++++++++++------------- 1 file changed, 15 insertions(+), 13 deletions(-) diff --git a/arch/x86/kernel/cpu/intel_rdt_schemata.c b/arch/x86/kernel/cpu/intel_rdt_schemata.c index e64b2cf..406d7a6 100644 --- a/arch/x86/kernel/cpu/intel_rdt_schemata.c +++ b/arch/x86/kernel/cpu/intel_rdt_schemata.c @@ -188,6 +188,17 @@ done: return 0; } +static int rdtgroup_parse_resource(char *resname, char *tok, int closid) +{ + struct rdt_resource *r; + + for_each_enabled_rdt_resource(r) { + if (!strcmp(resname, r->name) && closid < r->num_closid) + return parse_line(tok, r); + } + return -EINVAL; +} + ssize_t rdtgroup_schemata_write(struct kernfs_open_file *of, char *buf, size_t nbytes, loff_t off) { @@ -210,9 +221,10 @@ ssize_t rdtgroup_schemata_write(struct kernfs_open_file *of, closid = rdtgrp->closid; - for_each_enabled_rdt_resource(r) + for_each_enabled_rdt_resource(r) { list_for_each_entry(dom, &r->domains, list) dom->have_new_ctrl = false; + } while ((tok = strsep(&buf, "\n")) != NULL) { resname = strim(strsep(&tok, ":")); @@ -220,19 +232,9 @@ ssize_t rdtgroup_schemata_write(struct kernfs_open_file *of, ret = -EINVAL; goto out; } - for_each_enabled_rdt_resource(r) { - if (!strcmp(resname, r->name) && - closid < r->num_closid) { - ret = parse_line(tok, r); - if (ret) - goto out; - break; - } - } - if (!r->name) { - ret = -EINVAL; + ret = rdtgroup_parse_resource(resname, tok, closid); + if (ret) goto out; - } } for_each_enabled_rdt_resource(r) {