| Message ID | 20231010165101.14942-2-ajones@ventanamicro.com (mailing list archive) |
|---|---|
| State | Accepted |
| Commit | 899376e85ae5632e88f89c5b6b7b1d8c77294482 |
| Headers | show |
| Series | RISC-V: hwprobe: Fix vDSO SIGSEGV | expand |
On Tue, Oct 10, 2023 at 9:51 AM Andrew Jones <ajones@ventanamicro.com> wrote: > > A hwprobe pair key is signed, but the hwprobe vDSO function was > only checking that the upper bound was valid. In order to help > avoid this type of problem in the future, and in anticipation of > this check becoming more complicated with sparse keys, introduce > and use a "key is valid" predicate function for the check. > > Fixes: aa5af0aa90ba ("RISC-V: Add hwprobe vDSO function and data") > Signed-off-by: Andrew Jones <ajones@ventanamicro.com> Reviewed-by: Evan Green <evan@rivosinc.com>
Hello: This patch was applied to riscv/linux.git (for-next) by Palmer Dabbelt <palmer@rivosinc.com>: On Tue, 10 Oct 2023 18:51:02 +0200 you wrote: > A hwprobe pair key is signed, but the hwprobe vDSO function was > only checking that the upper bound was valid. In order to help > avoid this type of problem in the future, and in anticipation of > this check becoming more complicated with sparse keys, introduce > and use a "key is valid" predicate function for the check. > > Fixes: aa5af0aa90ba ("RISC-V: Add hwprobe vDSO function and data") > Signed-off-by: Andrew Jones <ajones@ventanamicro.com> > > [...] Here is the summary with links: - RISC-V: hwprobe: Fix vDSO SIGSEGV https://git.kernel.org/riscv/c/899376e85ae5 You are awesome, thank you!
diff --git a/arch/riscv/include/asm/hwprobe.h b/arch/riscv/include/asm/hwprobe.h index 78936f4ff513..7cad513538d8 100644 --- a/arch/riscv/include/asm/hwprobe.h +++ b/arch/riscv/include/asm/hwprobe.h @@ -10,4 +10,9 @@ #define RISCV_HWPROBE_MAX_KEY 5 +static inline bool riscv_hwprobe_key_is_valid(__s64 key) +{ + return key >= 0 && key <= RISCV_HWPROBE_MAX_KEY; +} + #endif diff --git a/arch/riscv/kernel/vdso/hwprobe.c b/arch/riscv/kernel/vdso/hwprobe.c index d40bec6ac078..cadf725ef798 100644 --- a/arch/riscv/kernel/vdso/hwprobe.c +++ b/arch/riscv/kernel/vdso/hwprobe.c @@ -37,7 +37,7 @@ int __vdso_riscv_hwprobe(struct riscv_hwprobe *pairs, size_t pair_count, /* This is something we can handle, fill out the pairs. */ while (p < end) { - if (p->key <= RISCV_HWPROBE_MAX_KEY) { + if (riscv_hwprobe_key_is_valid(p->key)) { p->value = avd->all_cpu_hwprobe_values[p->key]; } else {
A hwprobe pair key is signed, but the hwprobe vDSO function was only checking that the upper bound was valid. In order to help avoid this type of problem in the future, and in anticipation of this check becoming more complicated with sparse keys, introduce and use a "key is valid" predicate function for the check. Fixes: aa5af0aa90ba ("RISC-V: Add hwprobe vDSO function and data") Signed-off-by: Andrew Jones <ajones@ventanamicro.com> --- arch/riscv/include/asm/hwprobe.h | 5 +++++ arch/riscv/kernel/vdso/hwprobe.c | 2 +- 2 files changed, 6 insertions(+), 1 deletion(-)