]> git.itanic.dy.fi Git - linux-stable/commit
cxl/pci: Handle truncated CDAT entries
authorLukas Wunner <lukas@wunner.de>
Sat, 11 Mar 2023 14:40:03 +0000 (15:40 +0100)
committerDan Williams <dan.j.williams@intel.com>
Mon, 3 Apr 2023 23:16:34 +0000 (16:16 -0700)
commitb56faef2312057db20479b240eb71bd2e51fb51c
treebe8b86231c53421e28ad2b11d5be1a9eec4ad60e
parent34bafc747c54fb58c1908ec3116fa6137393e596
cxl/pci: Handle truncated CDAT entries

If truncated CDAT entries are received from a device, the concatenation
of those entries constitutes a corrupt CDAT, yet is happily exposed to
user space.

Avoid by verifying response lengths and erroring out if truncation is
detected.

The last CDAT entry may still be truncated despite the checks introduced
herein if the length in the CDAT header is too small.  However, that is
easily detectable by user space because it reaches EOF prematurely.
A subsequent commit which rightsizes the CDAT response allocation closes
that remaining loophole.

The two lines introduced here which exceed 80 chars are shortened to
less than 80 chars by a subsequent commit which migrates to a
synchronous DOE API and replaces "t.task.rv" by "rc".

The existing acpi_cdat_header and acpi_table_cdat struct definitions
provided by ACPICA cannot be used because they do not employ __le16 or
__le32 types.  I believe that cannot be changed because those types are
Linux-specific and ACPI is specified for little endian platforms only,
hence doesn't care about endianness.  So duplicate the structs.

Fixes: c97006046c79 ("cxl/port: Read CDAT table")
Tested-by: Ira Weiny <ira.weiny@intel.com>
Signed-off-by: Lukas Wunner <lukas@wunner.de>
Reviewed-by: Dan Williams <dan.j.williams@intel.com>
Reviewed-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Cc: stable@vger.kernel.org # v6.0+
Link: https://lore.kernel.org/r/bce3aebc0e8e18a1173425a7a865b232c3912963.1678543498.git.lukas@wunner.de
Signed-off-by: Dan Williams <dan.j.williams@intel.com>
drivers/cxl/core/pci.c
drivers/cxl/cxlpci.h