• Andrey Ryabinin's avatar
    platform/x86: intel_pmc_core: fix out-of-bounds accesses on stack · 4f24ecff
    Andrey Ryabinin authored
    pmc_core_mtpmc_link_status() an pmc_core_check_read_lock_bit() use
    test_bit() on local 32-bit variable. This causes out-of-bounds
    access since test_bit() expects object at least of 'unsigned long' size:
    
       BUG: KASAN: stack-out-of-bounds in pmc_core_probe+0x3aa/0x3b0
        Call Trace:
         __asan_report_load_n_noabort+0x5c/0x80
         pmc_core_probe+0x3aa/0x3b0
         local_pci_probe+0xf9/0x1e0
         pci_device_probe+0x27b/0x350
         driver_probe_device+0x419/0x830
         __driver_attach+0x15f/0x1d0
         bus_for_each_dev+0x129/0x1d0
         driver_attach+0x42/0x70
         bus_add_driver+0x385/0x690
         driver_register+0x1a9/0x3d0
         __pci_register_driver+0x1a2/0x290
         intel_pmc_core_driver_init+0x19/0x1b
         do_one_initcall+0x12e/0x280
         kernel_init_freeable+0x57c/0x623
         kernel_init+0x13/0x140
         ret_from_fork+0x2e/0x40
    
    Fix this by open coding bit test. While at it, also refactor this code
    a little bit.
    
    Fixes: 173943b3 ("platform/x86: intel_pmc_core: ModPhy core lanes pg status")
    Signed-off-by: default avatarAndrey Ryabinin <aryabinin@virtuozzo.com>
    [andy: reverted not related changes, used BIT() macro]
    Signed-off-by: default avatarAndy Shevchenko <andriy.shevchenko@linux.intel.com>
    4f24ecff
intel_pmc_core.c 14.6 KB