Unverified Commit c1fbbea2 authored by openeuler-ci-bot's avatar openeuler-ci-bot Committed by Gitee
Browse files

!2330 Add a check of uvhub_mask in init_per_cpu() 

Merge Pull Request from: @amon-s1eepy 
 
Hello, I am Zheng Haoran from School of Cyber Science and Technology in Beihang University. I find a possible bug, using a program analysis tool named BassCheck developed by our team.

In init_per_cpu(), uvhub_mask is allocated using kzalloc(GFP_KERNEL), which can fail and return NULL. Then uvhub_mask is used in the call to get_cpu_topology(uvhub_mask). In this function, uvhub_mask is used in the following code:
```
*(uvhub_mask + (uvhub/8)) |= (1 << (uvhub%8));
```
Thus, a null-pointer dereference can occur to crash the kernel. To fix this possible bug, uvhub_mask should be checked after the call to kzalloc(GFP_KERNEL). 
 
Link:https://gitee.com/openeuler/kernel/pulls/2330

 

Reviewed-by: default avatarWei Li <liwei391@huawei.com>
Signed-off-by: default avatarZhang Changzhong <zhangchangzhong@huawei.com>
parents 1977e125 8553763e

arch/x86/platform/uv/tlb_uv.c

+8 −7
Original line number Diff line number Diff line
@@ -2010,8 +2010,7 @@ static void make_per_cpu_thp(struct bau_control *smaster) 
	int cpu;

	size_t hpsz = sizeof(struct hub_and_pnode) * num_possible_cpus();



	smaster->thp = kmalloc_node(hpsz, GFP_KERNEL, smaster->osnode);

	memset(smaster->thp, 0, hpsz);

	smaster->thp = kzalloc_node(hpsz, GFP_KERNEL, smaster->osnode);

	for_each_present_cpu(cpu) {

		smaster->thp[cpu].pnode = uv_cpu_hub_info(cpu)->pnode;

		smaster->thp[cpu].uvhub = uv_cpu_hub_info(cpu)->numa_blade_id;
@@ -2134,17 +2133,19 @@ static int __init summarize_uvhub_sockets(int nuvhubs, 
 */

static int __init init_per_cpu(int nuvhubs, int base_part_pnode)

{

	unsigned char *uvhub_mask;

	void *vp;

	struct uvhub_desc *uvhub_descs;

	unsigned char *uvhub_mask = NULL;



	if (is_uv3_hub() || is_uv2_hub() || is_uv1_hub())

		timeout_us = calculate_destination_timeout();



	vp = kmalloc_array(nuvhubs, sizeof(struct uvhub_desc), GFP_KERNEL);

	uvhub_descs = (struct uvhub_desc *)vp;

	memset(uvhub_descs, 0, nuvhubs * sizeof(struct uvhub_desc));

	uvhub_descs = kcalloc(nuvhubs, sizeof(struct uvhub_desc), GFP_KERNEL);

	if (!uvhub_descs)

		goto fail;



	uvhub_mask = kzalloc((nuvhubs+7)/8, GFP_KERNEL);

	if (!uvhub_mask)

		goto fail;



	if (get_cpu_topology(base_part_pnode, uvhub_descs, uvhub_mask))

		goto fail;