From: Jonathan Cameron <Jonathan.Cameron@huawei.com> To: Liu Jingqi <jingqi.liu@intel.com>, <qemu-devel@nongnu.org>, <ankita@nvidia.com>, "Michael S . Tsirkin" <mst@redhat.com>, Igor Mammedov <imammedo@redhat.com>, Ani Sinha <anisinha@redhat.com> Cc: <linuxarm@huawei.com>, Markus Armbruster <armbru@redhat.com>, Daniel Black <daniel@linux.ibm.com>, <linux-cxl@vger.kernel.org> Subject: [PATCH 2/2] hmat acpi: Fix out of bounds access due to missing use of indirection Date: Thu, 29 Feb 2024 16:25:45 +0000 [thread overview] Message-ID: <20240229162545.7887-3-Jonathan.Cameron@huawei.com> (raw) In-Reply-To: <20240229162545.7887-1-Jonathan.Cameron@huawei.com> With a numa set up such as -numa nodeid=0,cpus=0 \ -numa nodeid=1,memdev=mem \ -numa nodeid=2,cpus=1 and appropriate hmat_lb entries the initiator list is correctly computed and writen to HMAT as 0,2 but then the LB data is accessed using the node id (here 2), landing outside the entry_list array. Stash the reverse lookup when writing the initiator list and use it to get the correct array index index. Fixes: 4586a2cb83 ("hmat acpi: Build System Locality Latency and Bandwidth Information Structure(s)") Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com> --- hw/acpi/hmat.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/hw/acpi/hmat.c b/hw/acpi/hmat.c index 723ae28d32..b933ae3c06 100644 --- a/hw/acpi/hmat.c +++ b/hw/acpi/hmat.c @@ -78,6 +78,7 @@ static void build_hmat_lb(GArray *table_data, HMAT_LB_Info *hmat_lb, uint32_t *initiator_list) { int i, index; + uint32_t initiator_to_index[MAX_NODES] = {}; HMAT_LB_Data *lb_data; uint16_t *entry_list; uint32_t base; @@ -121,6 +122,8 @@ static void build_hmat_lb(GArray *table_data, HMAT_LB_Info *hmat_lb, /* Initiator Proximity Domain List */ for (i = 0; i < num_initiator; i++) { build_append_int_noprefix(table_data, initiator_list[i], 4); + /* Reverse mapping for array possitions */ + initiator_to_index[initiator_list[i]] = i; } /* Target Proximity Domain List */ @@ -132,7 +135,8 @@ static void build_hmat_lb(GArray *table_data, HMAT_LB_Info *hmat_lb, entry_list = g_new0(uint16_t, num_initiator * num_target); for (i = 0; i < hmat_lb->list->len; i++) { lb_data = &g_array_index(hmat_lb->list, HMAT_LB_Data, i); - index = lb_data->initiator * num_target + lb_data->target; + index = initiator_to_index[lb_data->initiator] * num_target + + lb_data->target; entry_list[index] = (uint16_t)(lb_data->data / hmat_lb->base); } -- 2.39.2
WARNING: multiple messages have this Message-ID (diff)
From: Jonathan Cameron via <qemu-devel@nongnu.org> To: Liu Jingqi <jingqi.liu@intel.com>, <qemu-devel@nongnu.org>, <ankita@nvidia.com>, "Michael S . Tsirkin" <mst@redhat.com>, Igor Mammedov <imammedo@redhat.com>, Ani Sinha <anisinha@redhat.com> Cc: <linuxarm@huawei.com>, Markus Armbruster <armbru@redhat.com>, Daniel Black <daniel@linux.ibm.com>, <linux-cxl@vger.kernel.org> Subject: [PATCH 2/2] hmat acpi: Fix out of bounds access due to missing use of indirection Date: Thu, 29 Feb 2024 16:25:45 +0000 [thread overview] Message-ID: <20240229162545.7887-3-Jonathan.Cameron@huawei.com> (raw) In-Reply-To: <20240229162545.7887-1-Jonathan.Cameron@huawei.com> With a numa set up such as -numa nodeid=0,cpus=0 \ -numa nodeid=1,memdev=mem \ -numa nodeid=2,cpus=1 and appropriate hmat_lb entries the initiator list is correctly computed and writen to HMAT as 0,2 but then the LB data is accessed using the node id (here 2), landing outside the entry_list array. Stash the reverse lookup when writing the initiator list and use it to get the correct array index index. Fixes: 4586a2cb83 ("hmat acpi: Build System Locality Latency and Bandwidth Information Structure(s)") Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com> --- hw/acpi/hmat.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/hw/acpi/hmat.c b/hw/acpi/hmat.c index 723ae28d32..b933ae3c06 100644 --- a/hw/acpi/hmat.c +++ b/hw/acpi/hmat.c @@ -78,6 +78,7 @@ static void build_hmat_lb(GArray *table_data, HMAT_LB_Info *hmat_lb, uint32_t *initiator_list) { int i, index; + uint32_t initiator_to_index[MAX_NODES] = {}; HMAT_LB_Data *lb_data; uint16_t *entry_list; uint32_t base; @@ -121,6 +122,8 @@ static void build_hmat_lb(GArray *table_data, HMAT_LB_Info *hmat_lb, /* Initiator Proximity Domain List */ for (i = 0; i < num_initiator; i++) { build_append_int_noprefix(table_data, initiator_list[i], 4); + /* Reverse mapping for array possitions */ + initiator_to_index[initiator_list[i]] = i; } /* Target Proximity Domain List */ @@ -132,7 +135,8 @@ static void build_hmat_lb(GArray *table_data, HMAT_LB_Info *hmat_lb, entry_list = g_new0(uint16_t, num_initiator * num_target); for (i = 0; i < hmat_lb->list->len; i++) { lb_data = &g_array_index(hmat_lb->list, HMAT_LB_Data, i); - index = lb_data->initiator * num_target + lb_data->target; + index = initiator_to_index[lb_data->initiator] * num_target + + lb_data->target; entry_list[index] = (uint16_t)(lb_data->data / hmat_lb->base); } -- 2.39.2
next prev parent reply other threads:[~2024-02-29 16:26 UTC|newest] Thread overview: 9+ messages / expand[flat|nested] mbox.gz Atom feed top 2024-02-29 16:25 [PATCH 0/2 qemu] hw/acpi/hmat: Misc fixes Jonathan Cameron 2024-02-29 16:25 ` Jonathan Cameron via 2024-02-29 16:25 ` [PATCH 1/2] hmat acpi: Do not add Memory Proximity Domain Attributes Structure targetting non existent memory Jonathan Cameron 2024-02-29 16:25 ` Jonathan Cameron via 2024-02-29 17:28 ` Gregory Price 2024-02-29 17:52 ` Jonathan Cameron 2024-02-29 17:52 ` Jonathan Cameron via 2024-02-29 16:25 ` Jonathan Cameron [this message] 2024-02-29 16:25 ` [PATCH 2/2] hmat acpi: Fix out of bounds access due to missing use of indirection Jonathan Cameron via
Reply instructions: You may reply publicly to this message via plain-text email using any one of the following methods: * Save the following mbox file, import it into your mail client, and reply-to-all from there: mbox Avoid top-posting and favor interleaved quoting: https://en.wikipedia.org/wiki/Posting_style#Interleaved_style * Reply using the --to, --cc, and --in-reply-to switches of git-send-email(1): git send-email \ --in-reply-to=20240229162545.7887-3-Jonathan.Cameron@huawei.com \ --to=jonathan.cameron@huawei.com \ --cc=anisinha@redhat.com \ --cc=ankita@nvidia.com \ --cc=armbru@redhat.com \ --cc=daniel@linux.ibm.com \ --cc=imammedo@redhat.com \ --cc=jingqi.liu@intel.com \ --cc=linux-cxl@vger.kernel.org \ --cc=linuxarm@huawei.com \ --cc=mst@redhat.com \ --cc=qemu-devel@nongnu.org \ /path/to/YOUR_REPLY https://kernel.org/pub/software/scm/git/docs/git-send-email.html * If your mail client supports setting the In-Reply-To header via mailto: links, try the mailto: linkBe sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes, see mirroring instructions on how to clone and mirror all data and code used by this external index.