• Reinette Chatre's avatar
    x86/resctrl: Prevent possible overrun during bitmap operations · 32f010de
    Reinette Chatre authored
    While the DOC at the beginning of lib/bitmap.c explicitly states that
    "The number of valid bits in a given bitmap does _not_ need to be an
    exact multiple of BITS_PER_LONG.", some of the bitmap operations do
    indeed access BITS_PER_LONG portions of the provided bitmap no matter
    the size of the provided bitmap.
    
    For example, if find_first_bit() is provided with an 8 bit bitmap the
    operation will access BITS_PER_LONG bits from the provided bitmap. While
    the operation ensures that these extra bits do not affect the result,
    the memory is still accessed.
    
    The capacity bitmasks (CBMs) are typically stored in u32 since they
    can never exceed 32 bits. A few instances exist where a bitmap_*
    operation is performed on a CBM by simply pointing the bitmap operation
    to the stored u32 value.
    
    The consequence of this pattern is that some bitmap_* operations will
    access out-of-bounds memory when interacting with the provided CBM.
    
    This same issue has previously been addressed with commit 49e00eee
    ("x86/intel_rdt: Fix out-of-bounds memory access in CBM tests")
    but at that time not all instances of the issue were fixed.
    
    Fix this by using an unsigned long to store the capacity bitmask data
    that is passed to bitmap functions.
    
    Fixes: e6519011 ("x86/intel_rdt: Introduce "bit_usage" to display cache allocations details")
    Fixes: f4e80d67 ("x86/intel_rdt: Resctrl files reflect pseudo-locked information")
    Fixes: 95f0b77e ("x86/intel_rdt: Initialize new resource group with sane defaults")
    Signed-off-by: default avatarReinette Chatre <reinette.chatre@intel.com>
    Signed-off-by: default avatarBorislav Petkov <bp@suse.de>
    Cc: Fenghua Yu <fenghua.yu@intel.com>
    Cc: "H. Peter Anvin" <hpa@zytor.com>
    Cc: Ingo Molnar <mingo@redhat.com>
    Cc: stable <stable@vger.kernel.org>
    Cc: Thomas Gleixner <tglx@linutronix.de>
    Cc: Tony Luck <tony.luck@intel.com>
    Cc: x86-ml <x86@kernel.org>
    Link: https://lkml.kernel.org/r/58c9b6081fd9bf599af0dfc01a6fdd335768efef.1560975645.git.reinette.chatre@intel.com
    32f010de
rdtgroup.c 77 KB